# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:44:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44922: 535 Incorrect authentication data (set_id=rafal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:43:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18686: 535 Incorrect authentication data (set_id=jzhao)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 21 03:44:22 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.dcxmjd.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dcxmjd.com/pinfo.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-06-21 03:46:48 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net ([78.36.4.92]) [69.118.232.13]:42703: 535 Incorrect authentication data (set_id=inf@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:43:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59406: 535 Incorrect authentication data (set_id=zhangl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Jun 21 03:44:47 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.hepsipromosyon.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.hepsipromosyon.net/settings.json HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 03:44:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58526: 535 Incorrect authentication data (set_id=fed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:53:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30640: 535 Incorrect authentication data (set_id=dis)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-21 03:54:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:22797: 535 Incorrect authentication data (set_id=thumbs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:53:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9020: 535 Incorrect authentication data (set_id=foundation)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 21 03:53:36 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 03:53:13 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 03:53:23 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 03:53:24 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 21 03:54:29 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:53:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16842: 535 Incorrect authentication data (set_id=soma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 03:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13518: 535 Incorrect authentication data (set_id=leona)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 03:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64212: 535 Incorrect authentication data (set_id=pgsql)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 03:53:36 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 03:53:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56688: 535 Incorrect authentication data (set_id=avm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 03:53:24 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 03:54:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16166: 535 Incorrect authentication data (set_id=smmsp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 21 03:55:09 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:55:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25212: 535 Incorrect authentication data (set_id=testftp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 03:55:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7200: 535 Incorrect authentication data (set_id=hw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:55:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42754: 535 Incorrect authentication data (set_id=lo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 03:55:06 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 03:55:53 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 03:54:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29168: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.168.79.113
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=11135 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:55:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33428: 535 Incorrect authentication data (set_id=smtp7)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 03:55:20 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 03:54:49 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:56:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1216: 535 Incorrect authentication data (set_id=stv)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-21 03:56:20 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:44137: 535 Incorrect authentication data (set_id=terminal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 03:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36744: 535 Incorrect authentication data (set_id=grand)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39776: 535 Incorrect authentication data (set_id=remax)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 03:56:22 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 03:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44658: 535 Incorrect authentication data (set_id=morocco)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49720: 535 Incorrect authentication data (set_id=jg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 03:56:32 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:56:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11604: 535 Incorrect authentication data (set_id=remax)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 03:56:36 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 03:56:41 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 03:56:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36832: 535 Incorrect authentication data (set_id=morocco)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.138.186.188
country_id: 357994
description:
[2026-06-21 03:56:58 +0000] info [webmaild] 196.138.186.188 - supports@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 03:57:42 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 03:56:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22182: 535 Incorrect authentication data (set_id=mags)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:57:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15230: 535 Incorrect authentication data (set_id=upyours)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 03:56:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58908: 535 Incorrect authentication data (set_id=grand)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 03:57:03 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 03:57:09 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:56:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62824: 535 Incorrect authentication data (set_id=hys)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 03:56:39 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:56:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41542: 535 Incorrect authentication data (set_id=jg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 03:57:56 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:57:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13500: 535 Incorrect authentication data (set_id=ceo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 03:57:45 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:57:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17188: 535 Incorrect authentication data (set_id=painting)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 03:57:58 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 03:57:52 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:57:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55232: 535 Incorrect authentication data (set_id=response)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 03:57:51 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-21 03:57:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:49774: 535 Incorrect authentication data (set_id=snmp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 03:57:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49436: 535 Incorrect authentication data (set_id=east)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 03:58:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45434: 535 Incorrect authentication data (set_id=dhcp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 03:58:12 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 03:58:07 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 03:58:08 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 03:58:11 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 03:58:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11240: 535 Incorrect authentication data (set_id=east)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:58:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57932: 535 Incorrect authentication data (set_id=ceo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 03:58:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64268: 535 Incorrect authentication data (set_id=response)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 03:58:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9634: 535 Incorrect authentication data (set_id=hibino)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 03:58:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52590: 535 Incorrect authentication data (set_id=dhcp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:58:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14412: 535 Incorrect authentication data (set_id=diary)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 03:58:14 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 03:58:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58420: 535 Incorrect authentication data (set_id=rat)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 03:58:32 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 03:58:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10230: 535 Incorrect authentication data (set_id=diary)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 03:58:25 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 04:01:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22536: 535 Incorrect authentication data (set_id=webmail-old)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 21 04:01:23 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.101.160
country_id: 1527747
description:
2026-06-21 04:00:02 H=([212.42.101.160]) [212.42.101.160]:59444 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.72.195
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/siteweb/public/product/show/djama-panache HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.116
country_id: 6252001
description:
[2026-06-21 04:07:44 +0000] info [cpaneld] 173.211.88.116 NEW wcnyaruu:nBwLTJu54qYdqJA5 address=173.211.88.116,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 04:01:56 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 04:01:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53136: 535 Incorrect authentication data (set_id=golf)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 04:01:31 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 04:01:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59966: 535 Incorrect authentication data (set_id=ftp2009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 04:02:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42566: 535 Incorrect authentication data (set_id=arum)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 21 04:01:59 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 04:01:38 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 04:01:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59782: 535 Incorrect authentication data (set_id=fms)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-21 04:02:52 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:55189: 535 Incorrect authentication data (set_id=aa123456)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.38.238.180
country_id: 3175395
description:
2026-06-21 04:01:51 dovecot_login authenticator failed for H=93-38-238-180.ip73.fastwebnet.it (ip-67-21-79-198.sharktech.net) [93.38.238.180]:50647: 535 Incorrect authentication data (set_id=master@pin.cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 03:58:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53960: 535 Incorrect authentication data (set_id=suite)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 04:01:28 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 105.159.232.239
country_id: 2542007
description:
Jun 21 03:58:53 ns5 pure-ftpd[1217421]: (?@105.159.232.239) [INFO] New connection from 105.159.232.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 04:01:29 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.43
country_id: 6252001
description:
Jun 21 04:05:52 ns5 pure-ftpd[1221758]: (?@147.185.132.43) [INFO] New connection from 147.185.132.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.212.130
country_id: 3469034
description:
2026-06-21 04:01:25 dovecot_login authenticator failed for H=([186.239.254.4]) [187.51.212.130]:44453: 535 Incorrect authentication data (set_id=info@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.212.108.221
country_id: 2510769
domain: www.shekina.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:155.212.108.221||TA:155.212.108.221||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 04:12:56 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 04:09:40 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.69.119.99
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260531-WA0077-696x392-1-300x169.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.150.88.226
country_id: 3585968
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-300x169.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.187.28
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/images.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 04:07:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11492: 535 Incorrect authentication data (set_id=front1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 04:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18430: 535 Incorrect authentication data (set_id=gerard)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.242.21
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.46-768x1024.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.31.227
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Revolution-verte.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 04:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38906: 535 Incorrect authentication data (set_id=wxy)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.237.32
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Revolution-verte-300x168.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 04:08:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25984: 535 Incorrect authentication data (set_id=hazel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.213
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-300x225.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.50.68
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-3e-forum-de-la-cedeao-sur-leducation-a-la-culture-de-la-paix-ouvert-a-lome/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.230.95
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/Resolution-de-la-crise-Rwanda-RDC-Mission-diplomatique-du-chef-de-lEtat-a-Luanda--300x200.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 21 04:08:18 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.214.10.191
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900-300x185.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.223.178.13
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/78f515aac1ea7f8b8486130eaaec477b_L-300x198.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.156.160.147
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-768x576.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.172.128.32
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.46-225x300.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 04:12:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:15606: 535 Incorrect authentication data (set_id=nomail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.31.144
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg-225x300.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-21 04:07:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:11228: 535 Incorrect authentication data (set_id=bank)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 04:10:54 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 04:08:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41050: 535 Incorrect authentication data (set_id=witness)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 04:08:18 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 04:07:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22470: 535 Incorrect authentication data (set_id=fw02)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 118.248.210.254
country_id: 1814991
description:
2026-06-21 04:13:24 H=([118.248.210.254]) [118.248.210.254]:1049 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-21 04:09:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:27590: 535 Incorrect authentication data (set_id=casting)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 105.159.232.239
country_id: 2542007
description:
Jun 21 04:15:03 ns5 pure-ftpd[1227152]: (?@105.159.232.239) [WARNING] Authentication failed for user [trgtsjot]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 105.159.232.239
country_id: 2542007
description:
Jun 21 04:14:59 ns5 pure-ftpd[1227152]: (?@105.159.232.239) [INFO] New connection from 105.159.232.239


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 197.239.10.63
country_id: 226074
description:
[2026-06-21 04:18:52 +0000] info [cpaneld] 197.239.10.63 NEW pnls:_mJBsHNTE5WCU0uG address=197.239.10.63,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.153.176.77
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/images-2.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.217.172
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.58.102.214
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/2614e0e1edb58c8ddb2a6fc38995bb39_L.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.49.170
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-768x432.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.145.150
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260531-WA0077-696x392-1.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 04:23:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50016: 535 Incorrect authentication data (set_id=joshua)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 04:23:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19834: 535 Incorrect authentication data (set_id=wong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.255.142.131
country_id: 2661886
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/718085 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.57.19.101
country_id: 6252001
description:
2026-06-21 04:23:37 dovecot_login authenticator failed for H=ec2-13-57-19-101.us-west-1.compute.amazonaws.com (Ti17FRrUGS) [13.57.19.101]:56502: 535 Incorrect authentication data (set_id=rappels)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 04:24:17 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 04:24:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32668: 535 Incorrect authentication data (set_id=transit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 04:23:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46414: 535 Incorrect authentication data (set_id=code)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 04:24:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38938: 535 Incorrect authentication data (set_id=graciela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-21 04:23:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:38984: 535 Incorrect authentication data (set_id=yi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 04:24:12 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 04:24:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61512: 535 Incorrect authentication data (set_id=us2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 04:24:22 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 105.159.232.239
country_id: 2542007
description:
Jun 21 04:33:09 ns5 pure-ftpd[1239609]: (?@105.159.232.239) [WARNING] Authentication failed for user [it_togo@ariana.tg]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 04:24:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4498: 535 Incorrect authentication data (set_id=transit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 04:29:14 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-21 04:29:30 +0000] info [cpaneld] 196.171.5.203 - pnls "GET /cpsess0507368752/frontend/jupiter/index.html?=undefined&login=1&post_login=9400078006463 HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 04:29:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63976: 535 Incorrect authentication data (set_id=surat)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 04:24:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25856: 535 Incorrect authentication data (set_id=kang)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 04:24:24 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 04:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23044: 535 Incorrect authentication data (set_id=s120)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 04:24:33 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-21 04:29:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:24883: 535 Incorrect authentication data (set_id=dos)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 105.159.232.239
country_id: 2542007
description:
Jun 21 04:33:05 ns5 pure-ftpd[1239605]: (?@105.159.232.239) [INFO] New connection from 105.159.232.239


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 04:29:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6666: 535 Incorrect authentication data (set_id=stile)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 04:29:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26764: 535 Incorrect authentication data (set_id=adminhash)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 04:29:09 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 21 04:38:18 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.94
country_id: 933860
description:
Jun 21 04:46:49 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.94 has been locked due to Imunify RBL


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 49.207.251.81
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (49.207.251.81) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.stateofhospitality.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.stateofhospitality.com/i.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 21 04:38:46 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-21 04:38:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31128: 535 Incorrect authentication data (set_id=telnetd)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 146.70.194.228
country_id: 3017382
domain: societenouvelledeboisson.snb.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/web/wp-json/wp/v2/users/||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.245.115
country_id: 1643084
description:
[2026-06-21 04:45:42 +0000] info [whostmgrd] 103.253.245.115 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 21 04:50:34 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-21 04:38:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41310: 535 Incorrect authentication data (set_id=wl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 21 04:40:05 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-21 04:38:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42352: 535 Incorrect authentication data (set_id=doom)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 21 04:38:51 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.172.79.131
country_id: 1880251
description:
[2026-06-21 04:44:51 +0000] info [cpaneld] 167.172.79.131 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-21 04:50:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:62856: 535 Incorrect authentication data (set_id=postmasterdemo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.197
country_id: 690791
description:
Jun 21 04:39:56 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 152.42.201.102
country_id: 1880251
domain: dany2.mairie.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:czqxxxnu||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.99.172
country_id: 1880251
description:
[2026-06-21 04:39:59 +0000] info [cpaneld] 165.22.99.172 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.97.63
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/PM-Ecobank-300x199.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.67.84
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/09/decentralisation_togo-780x470-1.webp 780w, http:/togodailynews.tg/wp-content/uploads/2025/09/decentralisation_togo-780x470-1-300x181.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/09/decentralisation_togo-780x470-1-768x463.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.23.184.136
country_id: 3469034
description:
Jun 21 04:40:24 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.23.184.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-21 04:50:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:13582: 535 Incorrect authentication data (set_id=dev1)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 119.157.76.71
country_id: 1168579
description:
[2026-06-21 04:48:51 +0000] info [cpaneld] 119.157.76.71 NEW utkxprkk:1YCOGIlNHeQdxDIu address=119.157.76.71,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.46.48.148
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/atex-accompagne-500-fournisseurs-et-acheteurs HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.245.124.113
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/797673 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.40.111
country_id: 1168579
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2020/06/EbTXrLjWAAEpFC_.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Jun 21 04:38:56 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-21 04:38:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40660: 535 Incorrect authentication data (set_id=vandal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-21 04:38:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1468: 535 Incorrect authentication data (set_id=sterling)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.251.81
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f739c4b8b3b28ca1e3fa5d6777931e7034f35e39||Title:t81o4ey83zxxq2wgc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.142.25.92
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7883b1 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.255.73.134
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/588481937 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.164.161.6
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23991f38648e967b3f27b3930cefc0cad56bf6dc||Title:o3ykaqitzmbu57e||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-21 04:38:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27666: 535 Incorrect authentication data (set_id=sex)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 21 04:44:34 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.11.114
country_id: 3686110
description:
181.78.11.114 - - [21/Jun/2026:04:58:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053985&pdata=https%253A%252F%252Fwebmail.otf-boutique.free.netmaster.tg%252F%253Flocale%253Dhu&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017882 HTTP/2.0" 302 0 webmail.otf-boutique.free.netmaster.tg "https://webmail.otf-boutique.free.netmaster.tg/?locale=hu" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.11.114


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.86.56.176
country_id: 1282988
description:
103.86.56.176 - - [21/Jun/2026:04:58:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185155&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fsotral&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017932 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/sotral" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.86.56.176


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.244.80.23
country_id: 1269750
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-57.20.244.80.23||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 74.244.145.128
country_id: 3624060
description:
74.244.145.128 - - [21/Jun/2026:04:58:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316444&pdata=https%253A%252F%252Fcpanel.turkdef.free.netmaster.tg%252F%253Flocale%253Dru&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017932 HTTP/2.0" 302 0 cpanel.turkdef.free.netmaster.tg "https://cpanel.turkdef.free.netmaster.tg/?locale=ru" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.244.145.128


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.99.57
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/06/WhatsApp-Image-2021-06-10-at-14.47.48-1.jpeg 1080w, http:/togodailynews.tg/wp-content/uploads/2021/06/WhatsApp-Image-2021-06-10-at-14.47.48-1-300x249.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/06/WhatsApp-Image-2021-06-10-at-14.47.48-1-768x637.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2021/06/WhatsApp-Image-2021-06-10-at-14.47.48-1-1024x850.jpeg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.38.1.235
country_id: 290557
description:
5.38.1.235 - - [21/Jun/2026:04:57:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659590&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F10595&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017875 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/10595" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.38.1.235


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.70.85.193
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/45deb50b8acf5979f5f3cfc0b01f000a_XL.webp 770w, http:/togodailynews.tg/wp-content/uploads/2025/03/45deb50b8acf5979f5f3cfc0b01f000a_XL-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/03/45deb50b8acf5979f5f3cfc0b01f000a_XL-768x432.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.226.25.30
country_id: 1694008
description:
103.226.25.30 - - [21/Jun/2026:04:57:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907589&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fla-4eme-edition-du-mois-du-consommer-local-arrive-a-grand-pas%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017875 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Fla-4eme-edition-du-mois-du-consommer-local-arrive-a-grand-pas%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.226.25.30


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.138.71.215
country_id: 1643084
description:
103.138.71.215 - - [21/Jun/2026:04:58:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012314&pdata=https%253A%252F%252Fcpanel.appflutter.free.netmaster.tg%252F%253Flocale%253Des_es&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017887 HTTP/2.0" 302 0 cpanel.appflutter.free.netmaster.tg "https://cpanel.appflutter.free.netmaster.tg/?locale=es_es" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.138.71.215


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:04:56:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871879&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017783 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.204.151.122
country_id: 1210997
description:
116.204.151.122 - - [21/Jun/2026:04:56:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066791&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F10595&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782017805 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/10595" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.204.151.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.145.233.114
country_id: 1210997
description:
103.145.233.114 - - [21/Jun/2026:05:04:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858662&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F1868&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782018267 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/1868" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.145.233.114


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.226.231
country_id: 3865483
description:
Jun 21 05:04:54 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.226.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.225
country_id: 298795
description:
Jun 21 05:09:11 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.225 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 117.5.152.174
country_id: 1562822
description:
117.5.152.174 - - [21/Jun/2026:05:09:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198123&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fsociete%25252Ftogo-remise-du-nouveau-marche-dadeta-a-la-communaute%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782018566 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fsociete%2Ftogo-remise-du-nouveau-marche-dadeta-a-la-communaute%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:117.5.152.174


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.165.253.84
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/287728576 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.134.98
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1020761974 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.179.70.141
country_id: 1733045
description:
103.179.70.141 - - [21/Jun/2026:05:11:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263706&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fle-togo-bientot-membre-du-gggi%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782018704 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Fle-togo-bientot-membre-du-gggi%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.179.70.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:05:11:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868180&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782018701 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.167.97
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/d5cfbb HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.253.234.223
country_id: 3469034
description:
172.253.234.223 - - [21/Jun/2026:05:14:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052969&pdata=http%253A%252F%252Fcpanel.tps.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782018858 HTTP/1.1" 302 0 cpanel.tps.tg "http://cpanel.tps.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.253.234.223


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.142.167.104
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9fa9b4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.213.153
country_id: 1733045
description:
14.192.213.153 - - [21/Jun/2026:05:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790824&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F21319&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782018943 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/21319" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.213.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.128.158
country_id: 1733045
description:
113.211.128.158 - - [21/Jun/2026:05:16:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001257&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fassemblee-generale-des-nations-unies&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782018991 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/assemblee-generale-des-nations-unies" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.128.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.232.231.188
country_id: 1282988
description:
103.232.231.188 - - [21/Jun/2026:05:18:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986442&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fassemblee-generale-des-nations-unies&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019077 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/assemblee-generale-des-nations-unies" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.232.231.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jun 21 05:18:18 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.59.53.153
country_id: 1522867
description:
95.59.53.153 - - [21/Jun/2026:05:17:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7184287&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-togo-sur-la-voie-dun-redressement-economique-post-covid%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019038 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-togo-sur-la-voie-dun-redressement-economique-post-covid/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.4277.1069 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.59.53.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jun 21 05:18:31 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.163.113.33
country_id: 3469034
description:
45.163.113.33 - - [21/Jun/2026:05:21:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170413&pdata=https%253A%252F%252Fwww.snb.tg%252Falbum%252Fjeu-concours-capsule-2023&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019307 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/album/jeu-concours-capsule-2023" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1371.1351 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.163.113.33


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.55.81.1
country_id: 3017382
description:
203.55.81.1 - ruuwezvf [21/Jun/2026:05:22:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054554&pdata=https%253A%252F%252Fmafisteel.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019363 HTTP/2.0" 302 0 mafisteel.tg "https://mafisteel.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.55.81.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [21/Jun/2026:05:23:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868954&pdata=http%253A%252F%252Fcafeit.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019427 HTTP/1.1" 302 0 cafeit.tg "http://cafeit.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.211.149.26
country_id: 289688
description:
37.211.149.26 - - [21/Jun/2026:05:23:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738183&pdata=https%253A%252F%252Fcpanel.oliane.free.netmaster.tg%252F%253Flocale%253Dhe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019424 HTTP/2.0" 302 0 cpanel.oliane.free.netmaster.tg "https://cpanel.oliane.free.netmaster.tg/?locale=he" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.211.149.26


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.114.39.83
country_id: 3895114
description:
190.114.39.83 - - [21/Jun/2026:05:25:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261449&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12531&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019499 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12531" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.8175.1050 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.114.39.83


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:05:25:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592619&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019511 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:05:25:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131607&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019513 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.122.254.78
country_id: 1210997
description:
103.122.254.78 - - [21/Jun/2026:05:27:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247258&pdata=https%253A%252F%252Ftogodailynews.tg%252Felections-municipales-une-caravane-du-parti-unir-a-sillonne-les-arteres-dadjengre-et-daouda%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019624 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/elections-municipales-une-caravane-du-parti-unir-a-sillonne-les-arteres-dadjengre-et-daouda/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.4676.1778 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.122.254.78


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-21 05:28:22 +0000] info [cpaneld] 5.230.133.146 NEW hphhdcxi:mJsGXz7JacCMVh7_ address=5.230.133.146,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.184.188.127
country_id: 290291
description:
46.184.188.127 - - [21/Jun/2026:05:29:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065051&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9433&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019756 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9433" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.8981.1828 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.184.188.127


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.60
country_id: 6252001
description:
Jun 21 05:29:35 ns5 pure-ftpd[1285418]: (?@45.38.16.60) [WARNING] Authentication failed for user [stephane@sitewebofficiel.tg]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.152.142.191
country_id: 1210997
description:
103.152.142.191 - - [21/Jun/2026:05:31:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919883&pdata=http%253A%252F%252Ftogodailynews.tg%252Feducation-de-qualite-au-togo-la-politique-des-manuels-au-coeur-des-reformes&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782019892 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/education-de-qualite-au-togo-la-politique-des-manuels-au-coeur-des-reformes" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.152.142.191


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.171.104
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/105194522 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.159.74
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/85816f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.71.7
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1155576878 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.169.255.229
country_id: 3469034
description:
45.169.255.229 - - [21/Jun/2026:05:38:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593941&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fafis-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782020306 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/afis-lome/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.8996.1675 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.169.255.229


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.233
country_id: 2635167
description:
[2026-06-21 05:39:18 +0000] info [cpaneld] 5.230.133.233 NEW naduwpdk:LjtakLhWKNjfrm7L address=5.230.133.233,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:05:39:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13290644&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782020364 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:05:39:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118502&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782020365 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 94.201.23.235
country_id: 290557
description:
94.201.23.235 - - [21/Jun/2026:05:42:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936597&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpremier-forum-economique-des-diasporas-africaines-lance-par-robert-dussey%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782020536 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/premier-forum-economique-des-diasporas-africaines-lance-par-robert-dussey/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:94.201.23.235


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.237.24.236
country_id: 1562822
description:
171.237.24.236 - - [21/Jun/2026:05:41:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054803&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-le-gouvernement-donne-des-precisions-sur-la-hausse-des-prix-des-produits-petroliers-a-la-pompe%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782020506 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-le-gouvernement-donne-des-precisions-sur-la-hausse-des-prix-des-produits-petroliers-a-la-pompe/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.237.24.236


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.217.249.50
country_id: 1814991
description:
2026-06-21 05:43:15 H=([115.217.249.50]) [115.217.249.50]:54346 F=<kumar@white-ways.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.167
country_id: 1269750
description:
Jun 21 05:44:48 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.153
country_id: 2300660
description:
Jun 21 05:46:54 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.170
country_id: 1269750
description:
2026-06-21 05:47:00 dovecot_plain authenticator failed for H=(rutopances) [122.186.219.170]:34258: 535 Incorrect authentication data (set_id=57936965@white-ways.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.199.226.214
country_id: 1282988
description:
113.199.226.214 - - [21/Jun/2026:05:49:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857646&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnord-togo-des-pluies-de-normales-a-excedentaires-attendues&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782020941 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/nord-togo-des-pluies-de-normales-a-excedentaires-attendues" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.199.226.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.88
country_id: 3469034
description:
Jun 21 05:49:28 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.217.249.50
country_id: 1814991
description:
2026-06-21 05:48:58 H=([115.217.249.50]) [115.217.249.50]:62624 F=<kumar@white-ways.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.217.249.50
country_id: 1814991
description:
2026-06-21 05:49:37 H=([115.217.249.50]) [115.217.249.50]:63318 F=<kumar@white-ways.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.88
country_id: 3469034
description:
Jun 21 05:49:36 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.189.17.236
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bab3ad HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.228.194
country_id: 357994
description:
2026-06-21 05:52:23 dovecot_plain authenticator failed for H=(natchemoe) [197.47.228.194]:49806: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-21 05:53:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46332: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:05:56:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973846&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782021368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:05:56:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6474139&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782021360 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.153.210.115
country_id: 1210997
description:
103.153.210.115 - - [21/Jun/2026:05:59:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869976&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-universite-de-lome-ouverture-du-concours-dentree-a-linstitut-national-de-la-jeunesse-et-des-sports%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782021549 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-universite-de-lome-ouverture-du-concours-dentree-a-linstitut-national-de-la-jeunesse-et-des-sports/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.1905.1225 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.153.210.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.107.101
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1473202954 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 136.169.169.235
country_id: 2017370
description:
2026-06-21 05:59:52 H=([136.169.169.235]) [136.169.169.235]:16129 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.2.210
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bcb0a0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:06:09:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067143&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782022163 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:06:09:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936290&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782022165 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.46
country_id: 933860
description:
Jun 21 06:11:43 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.199.216
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a19574 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 136.169.169.235
country_id: 2017370
description:
2026-06-21 06:14:30 H=([136.169.169.235]) [136.169.169.235]:16198 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 136.169.169.235
country_id: 2017370
description:
2026-06-21 06:15:21 H=([136.169.169.235]) [136.169.169.235]:16035 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.167.41.202
country_id: 6252001
description:
2026-06-21 06:16:11 dovecot_plain authenticator failed for H=202.41.167.72.host.secureserver.net ([127.0.0.1]) [72.167.41.202]:47504: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-21 06:18:52 +0000] info [cpaneld] 5.230.133.44 NEW mbyqtkiw:_VLpMKjxaY38DoyZ address=5.230.133.44,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.237.13
country_id: 1733045
description:
180.75.237.13 - - [21/Jun/2026:06:19:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118855&pdata=https%253A%252F%252Fcfpj.tg%252Fgizz-307033netidm52zin.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782022777 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/gizz-307033netidm52zin.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.237.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.97.109.35
country_id: 1562822
description:
116.97.109.35 - - [21/Jun/2026:06:19:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866837&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F39660&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782022768 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/39660" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.97.109.35


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.120.246.181
country_id: 3865483
description:
190.120.246.181 - - [21/Jun/2026:06:21:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673068&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-144121retidm90der.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782022871 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-144121retidm90der.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.120.246.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.182.201.25
country_id: 2921044
description:
84.182.201.25 - - [21/Jun/2026:06:22:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921115&pdata=https%253A%252F%252Fwebmail.africa.netmaster.tg%252F%253Flocale%253Duk&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782022977 HTTP/2.0" 302 0 webmail.africa.netmaster.tg "https://webmail.africa.netmaster.tg/?locale=uk" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.182.201.25


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.61.128.38
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/AATC-commissioning-1024x623-1.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/04/AATC-commissioning-1024x623-1-300x183.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/04/AATC-commissioning-1024x623-1-768x467.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.226.67
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/Conseil-des-ministres-du-1er-avril-2026-768x614.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.64.132.162
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/Elaboration-de-la-feuille-de-route-gouvernementale-2026-2031-consultation-des-parties-prenantes-au-developpement-768x468.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:06:24:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064539&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782023061 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.122.73.102
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/9809ee919700b462ba2323b5076cbe67_L.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:06:24:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212570&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782023082 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.207.224.113
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1729730693 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-06-21 06:24:40 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:56524: 535 Incorrect authentication data (set_id=info@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.57
country_id: 933860
description:
Jun 21 06:27:35 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.19
country_id: 6252001
description:
205.169.39.19 - - [21/Jun/2026:06:28:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13341540&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782023313 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.231.156.75
country_id: 285570
description:
37.231.156.75 - - [21/Jun/2026:06:31:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312483&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F18%252Fhommages-a-togbui-agokoli-iv-les-confessions-religieuses-aux-cotes-de-la-famille-royale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782023493 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/18/hommages-a-togbui-agokoli-iv-les-confessions-religieuses-aux-cotes-de-la-famille-royale/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.6871.1610 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.231.156.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.82.19
country_id: 1668284
description:
2026-06-21 06:35:09 dovecot_plain authenticator failed for H=(cc1zf57bx2wpg98aflpk36z) [185.213.82.19]:46087: 535 Incorrect authentication data (set_id=andre.k@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-06-21 06:37:51 dovecot_plain authenticator failed for H=(spact) [122.187.221.130]:37340: 535 Incorrect authentication data (set_id=hr@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.125.79
country_id: 6252001
description:
[2026-06-21 06:39:00 +0000] info [cpaneld] 82.40.125.79 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:06:39:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210518&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782023987 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.195.94.243
country_id: 2017370
description:
2026-06-21 06:40:25 dovecot_login authenticator failed for H=([174.64.199.74]) [217.195.94.243]:45898: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:06:39:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168914&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782023988 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.178
country_id: 2186224
description:
2026-06-21 06:40:54 dovecot_login authenticator failed for H=([183.171.61.178]) [121.73.163.178]:44944: 535 Incorrect authentication data (set_id=phipa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.137
country_id: 732800
description:
Jun 21 06:41:29 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.163.178
country_id: 2186224
description:
Jun 21 06:40:52 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.163.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.89.171
country_id: 6252001
description:
[2026-06-21 06:42:13 +0000] info [cpaneld] 82.40.89.171 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.32
country_id: 3469034
description:
Jun 21 06:42:29 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [21/Jun/2026:06:41:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248284&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D4&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782024090 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=4" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.137
country_id: 732800
description:
Jun 21 06:41:36 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.32
country_id: 3469034
description:
Jun 21 06:42:37 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [21/Jun/2026:06:48:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804184&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782024481 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.179.108
country_id: 3175395
description:
Jun 21 06:49:16 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.179.108
country_id: 3175395
description:
Jun 21 06:49:29 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.179.108 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.34.229
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/790875990 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.81.59
country_id: 6252001
description:
[2026-06-21 06:54:37 +0000] info [cpaneld] 82.40.81.59 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.106.129
country_id: 798544
description:
Jun 21 06:55:22 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.106.129 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:06:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262680&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782024937 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:06:55:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13355632&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782024945 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.163.26
country_id: 1880251
description:
104.28.163.26 - - [21/Jun/2026:06:56:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146469&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fpurchases%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782024985 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/purchases/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.163.26


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.95.43.221
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/un-bateau-de-croisiere-accueilli-au-port-autonome-de-lome/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.95.43.221
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/un-bateau-de-croisiere-accueilli-au-port-autonome-de-lome/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [21/Jun/2026:06:57:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234459&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782025025 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.189.19.197
country_id: 3577279
description:
186.189.19.197 - - [21/Jun/2026:06:57:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6394828&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvoltic-togo-partenaire-du-festival-togo-media-foot%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782025075 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/voltic-togo-partenaire-du-festival-togo-media-foot/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.6674.1319 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.189.19.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.145.218.95
country_id: 1733045
description:
175.145.218.95 - - [21/Jun/2026:07:00:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135513&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Feconomie%25252Ftogo-le-conseil-economique-et-social-se-precise%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782025207 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Feconomie%2Ftogo-le-conseil-economique-et-social-se-precise%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.145.218.95


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 31.218.87.38
country_id: 290557
domain: macite.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:q||MV:59--des-consommateurs-ivoiriens-ont-deja-utilise-lia-pour-leurs-achats-mais-la-confiance-reste-decisive-au-moment-du-paiement||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.7.229.48
country_id: 3865483
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2022/11/AGENT.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.29.229.24
country_id: 1814991
description:
[2026-06-21 07:06:28 +0000] info [whostmgrd] 111.29.229.24 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.146.187
country_id: 3686110
domain: www.zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.zephyr.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.146.187
country_id: 3686110
domain: www.zephyr.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.zephyr.tghttp/www.zephyr.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.122.18.82
country_id: 6252001
description:
2026-06-21 07:07:35 dovecot_login authenticator failed for H=109-122-18-82.ixroot.network (ADMIN) [109.122.18.82]:59349: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:07:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950124&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782025708 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:07:08:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328470&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782025710 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.214.63.32
country_id: 630336
description:
2026-06-21 07:12:50 dovecot_login authenticator failed for H=(45.58.136.104) [37.214.63.32]:3479: 535 Incorrect authentication data (set_id=sales@cameg-togo.tg)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.194.178.66
country_id: 3017382
domain: yoto2.mairie.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dvhzmira/public_html/wp-includes/SimplePie/Cache/Base.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.194.178.95
country_id: 3017382
domain: yoto2.mairie.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dvhzmira/public_html/wp-includes/SimplePie/Cache/Memcached.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.159.50
country_id: 1880251
description:
104.28.159.50 - - [21/Jun/2026:07:14:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276562&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fpresentation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782025964 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/presentation/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.159.50


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-21 07:13:33 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:36352: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.120.178.198
country_id: 798549
description:
2026-06-21 07:13:51 dovecot_login authenticator failed for H=(ip-67-21-79-198.sharktech.net) [86.120.178.198]:53912: 535 Incorrect authentication data (set_id=clients@metaart.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 49.49.194.38
country_id: 1605651
description:
49.49.194.38 - - [21/Jun/2026:07:16:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381210&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026183 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:49.49.194.38


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.194.178.83
country_id: 3017382
domain: yoto2.mairie.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dvhzmira/public_html/wp-includes/sodium_compat/src/Crypto32.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.194.178.85
country_id: 3017382
domain: yoto2.mairie.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dvhzmira/public_html/wp-includes/sodium_compat/src/Compat.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.194.178.71
country_id: 3017382
domain: yoto2.mairie.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dvhzmira/public_html/wp-includes/sodium_compat/autoload-php7.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.192.47.229
country_id: 2017370
description:
Jun 21 07:19:10 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.192.47.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.192.47.229
country_id: 2017370
description:
2026-06-21 07:19:12 dovecot_login authenticator failed for H=l37-192-47-229.novotelecom.ru ([27.123.113.86]) [37.192.47.229]:48916: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.59.39.11
country_id: 1210997
description:
103.59.39.11 - - [21/Jun/2026:07:18:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923942&pdata=https%253A%252F%252Fcpanel.tdopz.free.netmaster.tg%252F%253Flocale%253Dda&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026330 HTTP/2.0" 302 0 cpanel.tdopz.free.netmaster.tg "https://cpanel.tdopz.free.netmaster.tg/?locale=da" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.59.39.11


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.51.41.112
country_id: 290557
description:
2.51.41.112 - - [21/Jun/2026:07:20:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379096&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F2047&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026427 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/2047" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.51.41.112


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.234.255.25
country_id: 3658394
description:
177.234.255.25 - - [21/Jun/2026:07:20:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066588&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fcedeao%252Fpage%252F8%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026406 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/cedeao/page/8/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8807.1971 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.234.255.25


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.249.181.131
country_id: 719819
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/FEDA-logo-3.png 316w, http:/togodailynews.tg/wp-content/uploads/2024/09/FEDA-logo-3-300x236.png 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:07:22:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919016&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026558 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:07:22:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458774&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026560 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [21/Jun/2026:07:25:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789739&pdata=https%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026707 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.14.38.234
country_id: 6252001
description:
[2026-06-21 07:24:37 +0000] info [cpaneld] 173.14.38.234 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [21/Jun/2026:07:26:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659525&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782026810 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.13
country_id: 6252001
domain: ekeasarl.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.106
country_id: 2921044
description:
[2026-06-21 07:30:48 +0000] info [cpaneld] 5.175.229.106 NEW cietg:6tsSRy12XDzckU2b address=5.175.229.106,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 21 07:31:25 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 21 07:30:30 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 21 07:31:31 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.90.185.5
country_id: 130758
domain: caissederetraites.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-32.77.90.185.5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 217.164.182.222
country_id: 290557
description:
217.164.182.222 - - [21/Jun/2026:07:33:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184337&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcouple-avec-5-enfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782027210 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/couple-avec-5-enfants/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3321.1164 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:217.164.182.222


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.157.46.161
country_id: 2542007
description:
105.157.46.161 - - [21/Jun/2026:07:33:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645859&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvente-illiciteme-de-poches-de-sang-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782027229 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vente-illiciteme-de-poches-de-sang-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.1172.1432 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.157.46.161


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.144.184
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/Shelter-Afrique-HQ-Drone-Image-1.jpg 3319w, http:/togodailynews.tg/wp-content/uploads/2021/07/Shelter-Afrique-HQ-Drone-Image-1-300x175.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/Shelter-Afrique-HQ-Drone-Image-1-768x447.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/07/Shelter-Afrique-HQ-Drone-Image-1-1024x596.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:07:39:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195860&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782027554 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:07:39:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867931&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782027556 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 195.140.176.46
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-39.195.140.176.46||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 148.222.130.165
country_id: 3865483
description:
148.222.130.165 - - [21/Jun/2026:07:42:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788713&pdata=https%253A%252F%252Fwebmail.whereis.free.netmaster.tg%252F%253Flocale%253Dhe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782027751 HTTP/2.0" 302 0 webmail.whereis.free.netmaster.tg "https://webmail.whereis.free.netmaster.tg/?locale=he" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:148.222.130.165


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.9.246
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/images-4.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.244.93.182
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-300x188.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.60.211
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-21-at-08.37.31-768x512.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.38.49
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/cropped-cropped-cropped-Logo-TDN.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.172.159
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/digital-transformation-solutions-300x169.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.56.59.180
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/ouida.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.163.182.87
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/WhatsApp-Image-2026-03-22-at-14.02.20-1.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.155.12.63
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Justin_Pilante1-860x645-1-300x225.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.181.41.35
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b7fbad3f731248b118a4dc4caa9b90b8_L.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.88.221
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344-300x239.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.4.47
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/digital-transformation-solutions-768x432.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.99.170
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/Afreximbank-e1775648513640-768x403.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.85.85
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/33-1024x768-1-300x225.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.18.202
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-768x480.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.55.76.33
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/ATDI-German-Embassy_211-1-768x512.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.108.53
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/madagascarnewsroom-madagascar-assurance-agricole-ifc-300x180.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.2.221
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Justin_Pilante1-860x645-1-768x576.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.169.11
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/WhatsApp-Image-2026-03-17-at-22.34.41-768x432.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.210.28.44
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L-300x200.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.161.197
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-300x200.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.55.70
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b7fbad3f731248b118a4dc4caa9b90b8_L-300x169.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.245.58
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/WhatsApp-Image-2026-03-29-at-10.42.54.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-21 07:48:11 +0000] info [cpaneld] 196.171.5.203 NEW pnls:ptrS_jKssDFwhA7p address=196.171.5.203,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [21/Jun/2026:07:49:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054812&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028166 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.198
country_id: 3469034
description:
Jun 21 07:48:30 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-21 07:50:16 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.159.50
country_id: 1880251
description:
104.28.159.50 - - [21/Jun/2026:07:49:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604996&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fpurchases%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028189 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/purchases/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.159.50


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.93.7.8
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/le-commerce-annuel-entre-lafrique-et-les-caraibes-pourrait-atteindre-18-milliard-de-dollars-dici-2028-selon-une-etude-itc-afreximbank/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.121.7.177
country_id: 630336
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-lautonomie-energetique-un-pari-en-passe-detre-gagne HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [21/Jun/2026:07:51:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842982&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028279 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.187.120
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-la-covid-19-le-togo-receptionne-475-200-doses-du-vaccin-johnson-johnson/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-21 07:51:38 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-21 07:52:41 +0000] info [cpaneld] 107.175.5.177 NEW mbyqtkiw:GdTMk3oBrhwB8qBq address=107.175.5.177,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.33.42
country_id: 1643084
description:
[2026-06-21 07:53:03 +0000] info [whostmgrd] 182.9.33.42 - Turblote "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.156.235.142
country_id: 2017370
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/03/IMG-20210319-WA0069.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2021/03/IMG-20210319-WA0069-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/03/IMG-20210319-WA0069-768x432.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/03/IMG-20210319-WA0069-1024x576.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.215.96.226
country_id: 290557
description:
31.215.96.226 - - [21/Jun/2026:07:53:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313303&pdata=https%253A%252F%252F24heureinfo.tg%252Ffinances%252Ftogo-global-trade-corporation-lorgne-dubai-pour-conquerir-le-reste-du-monde%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028413 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/finances/togo-global-trade-corporation-lorgne-dubai-pour-conquerir-le-reste-du-monde/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.215.96.226


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:07:53:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328514&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028429 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:07:53:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081755&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028429 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 141.227.139.224
country_id: 2658434
description:
141.227.139.224 - - [21/Jun/2026:07:55:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896201&pdata=https%253A%252F%252Fmatwtogo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028514 HTTP/2.0" 302 0 matwtogo.org "https://matwtogo.org/" "Mozilla/5.0 (Linux; arm_64; Android 13; 21091116AG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.117 YaBrowser/26.4.4.117.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:141.227.139.224


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.163.192.132
country_id: 1512440
description:
198.163.192.132 - - [21/Jun/2026:07:55:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065048&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-356587letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028544 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-356587letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.163.192.132


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.207.7.174
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1036500668 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.89.157.243
country_id: 1282988
description:
103.89.157.243 - - [21/Jun/2026:07:57:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011802&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Fsotouboua-tchamba-tchaoudjo-lt-col-hodin-poursuit-sa-tournee%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028620 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/societe/sotouboua-tchamba-tchaoudjo-lt-col-hodin-poursuit-sa-tournee/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.89.157.243


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-21 07:58:09 +0000] info [whostmgrd] 203.147.139.82 NEW root:2isU5EP4YuJRgtlz address=203.147.139.82,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:mY3QSXvWjUL0DY7S:create_user_session,possessed=0


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.52
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Indicateurs de performance  et Implantation de syst\xc3\xa8mes de Suivi-Evaluation : Les acteurs de mise en \xc5\x93uvre des r\xc3\xa9formes outill\xc3\xa9s||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 210.186.196.51
country_id: 1733045
description:
210.186.196.51 - - [21/Jun/2026:07:57:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13091689&pdata=https%253A%252F%252Fcpanel.gatti.free.netmaster.tg%252F%253Flocale%253Dpt_br&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028668 HTTP/2.0" 302 0 cpanel.gatti.free.netmaster.tg "https://cpanel.gatti.free.netmaster.tg/?locale=pt_br" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:210.186.196.51


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 176.227.240.63
country_id: 1269750
description:
[2026-06-21 07:59:21 +0000] info [cpaneld] 176.227.240.63 NEW cietg:HL170eRM446WQS4V address=176.227.240.63,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.35.161
country_id: 6252001
description:
[2026-06-21 08:00:20 +0000] info [cpaneld] 23.83.35.161 - sodegoz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodegoz (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.199.60.176
country_id: 1880251
description:
[2026-06-21 08:00:24 +0000] info [cpaneld] 138.199.60.176 - cietg "GET /cpsess6858254156/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [176.227.240.63] != Current IP Address [138.199.60.176]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [21/Jun/2026:08:00:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432548&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782028839 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-21 08:01:03 +0000] info [cpaneld] 203.147.139.82 NEW veljlkpg:dWVoasgPJ7s1Lf8Z address=203.147.139.82,app=cpaneld,creator=veljlkpg,method=handle_form_login,path=loadsession:veljlkpg:XracbP9vRFnsZ8ab,possessed=0


plugin: ossec
rule: 11009
name: WHM login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-21 08:01:01 +0000] info [whostmgrd] 203.147.139.82 NEW veljlkpg:XracbP9vRFnsZ8ab address=203.147.139.82,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 21 08:07:18 ns5.netmaster.tg cpanel_fileman_hook[1384058]: 0 BAILOUT malware detected when save 'kdor.html' in /home/bighostingsnbd/public_html/siteweb/public/img for user bighostingsnbd


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.5.84.196
country_id: 3585968
description:
179.5.84.196 - - [21/Jun/2026:08:07:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196420&pdata=https%253A%252F%252Fwebmail.s2ci.free.netmaster.tg%252F%253Flocale%253Dvi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782029272 HTTP/2.0" 302 0 webmail.s2ci.free.netmaster.tg "https://webmail.s2ci.free.netmaster.tg/?locale=vi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.5.84.196


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.214.142.236
country_id: 1819730
description:
[2026-06-21 08:07:32 +0000] info [cpaneld] 103.214.142.236 NEW ifxmoxbf:aDgOqgiRDpAuEFsn address=103.214.142.236,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-21 08:10:30 +0000] info [cpaneld] 5.230.153.211 NEW cinemafreenetmas:okL1904dnrtOpw1s address=5.230.153.211,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:08:09:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196076&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782029375 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:08:09:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13224552&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782029371 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.182
country_id: 3017382
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.489996662135149.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.71.187.124
country_id: 6252001
domain: www.hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.31 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.141.209.224
country_id: 1210997
description:
103.141.209.224 - - [21/Jun/2026:08:21:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938395&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-190186kitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782030075 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-190186kitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.141.209.224


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.174.63
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Opportunit\xc3\xa9s d\xe2\x80\x99investissement\xc2\xa0: Lom\xc3\xa9 accueille l\xe2\x80\x99Africa executing meeting 2023||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:08:24:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817768&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782030289 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:08:25:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619870&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782030311 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.20.58.1
country_id: 798544
description:
2026-06-21 08:31:55 dovecot_login authenticator failed for H=(46.20.58.22) [46.20.58.1]:52054: 535 Incorrect authentication data (set_id=adegunle.bikounle@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-21 08:31:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:63359: 535 Incorrect authentication data (set_id=pronto)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.163.173.115
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/838393 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.79
country_id: 2635167
description:
[2026-06-21 08:37:32 +0000] info [cpaneld] 5.230.133.79 NEW sodigaz:eCwbroG95g_WvxpP address=5.230.133.79,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.86
country_id: 3017382
description:
[2026-06-21 08:38:28 +0000] info [cpaneld] 5.231.64.86 NEW formationfreenet:88V3BG20H_R5B9A9 address=5.231.64.86,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-21 08:38:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:34247: 535 Incorrect authentication data (set_id=robo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 21 08:38:52 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.31.153
country_id: 6251999
description:
[2026-06-21 08:38:39 +0000] info [whostmgrd] 85.12.31.153 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:08:39:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868233&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782031164 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 182.8.179.38
country_id: 1643084
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-39.182.8.179.38||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:08:39:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329541&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782031172 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.172.220.214
country_id: 298795
domain: sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.172.220.214
country_id: 298795
domain: sp-eau.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tghttp/sp-eau.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.47
country_id: 2635167
description:
[2026-06-21 08:40:34 +0000] info [cpaneld] 5.230.153.47 NEW sodigaz:sl5QHbWiCC76Y7fG address=5.230.153.47,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.26
country_id: 1562822
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-40.117.5.142.26||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [21/Jun/2026:08:43:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882257&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkokou-dodji-fanny%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782031418 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kokou-dodji-fanny/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-21 08:45:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:61571: 535 Incorrect authentication data (set_id=zimbabwe)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.251.106.31
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1935565638 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.52.138.215
country_id: 690791
description:
2026-06-21 08:46:42 dovecot_login authenticator failed for H=(ip-67-21-79-198.sharktech.net) [92.52.138.215]:39440: 535 Incorrect authentication data (set_id=mail@davetechno.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.31.153
country_id: 6251999
description:
[2026-06-21 08:47:51 +0000] info [cpaneld] 85.12.31.153 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.34.195.12
country_id: 1522867
description:
2026-06-21 08:48:52 H=([46.34.195.42]) [46.34.195.12]:61166 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.83.114.68
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6167.85 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.76
country_id: 798544
description:
Jun 21 08:52:14 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-21 08:52:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:54239: 535 Incorrect authentication data (set_id=margie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 21 08:52:41 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:08:54:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934278&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782032088 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.31.153
country_id: 6251999
description:
[2026-06-21 08:55:44 +0000] info [cpaneld] 85.12.31.153 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-21 08:55:42 +0000] info [cpaneld] 5.230.133.148 NEW frtwilql:BbFqnewwXgbqY3sx address=5.230.133.148,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-21 08:56:04 +0000] info [cpaneld] 5.230.153.38 NEW formationfreenet:PsqgIyF2Rsr8bHs9 address=5.230.153.38,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 21 08:59:28 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-21 08:59:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:53492: 535 Incorrect authentication data (set_id=loic)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.130.241
country_id: 6252001
domain: ave2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:161.123.130.241||TA:161.123.130.241||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.97.239.178
country_id: 3625428
description:
190.97.239.178 - - [21/Jun/2026:09:01:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974058&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-groupe-togocom-presente-la-derc-aux-medias%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782032481 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-groupe-togocom-presente-la-derc-aux-medias/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.97.239.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.162.136.23
country_id: 1168579
description:
103.162.136.23 - - [21/Jun/2026:09:00:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711493&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782032453 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.162.136.23


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.237.239.19
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a847b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.31.153
country_id: 6251999
description:
[2026-06-21 09:03:19 +0000] info [cpaneld] 85.12.31.153 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.38.113.14
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/inclusion-sociale-le-programme-wezou-lance/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.170.39.223
country_id: 6252001
description:
[2026-06-21 09:17:27 +0000] info [cpaneld] 148.170.39.223 - manumointie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manumointie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.197.111.168
country_id: 6252001
description:
[2026-06-21 09:17:30 +0000] info [cpaneld] 67.197.111.168 - manumointie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manumointie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.228.24.104
country_id: 6252001
description:
[2026-06-21 09:17:49 +0000] info [cpaneld] 216.228.24.104 - manumointie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manumointie (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.30
country_id: 6252001
description:
205.169.39.30 - - [21/Jun/2026:09:20:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973383&pdata=https%253A%252F%252Fwww.hotel-yabisso.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782033600 HTTP/2.0" 302 0 www.hotel-yabisso.com "https://www.hotel-yabisso.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.54
country_id: 798544
description:
Jun 21 09:25:18 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.54 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:09:24:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713746&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782033879 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.54
country_id: 798544
description:
Jun 21 09:25:31 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.220.21.94
country_id: 3865483
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/onmt-medecins-tableau-ordre-national-medecins-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.220.21.94
country_id: 3865483
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/onmt-medecins-tableau-ordre-national-medecins-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.114.25.206
country_id: 1282988
description:
103.114.25.206 - - [21/Jun/2026:09:28:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789016&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fforum-de-paris-sur-la-paix&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782034097 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/forum-de-paris-sur-la-paix" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.114.25.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [21/Jun/2026:09:32:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116387&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782034357 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.19.172
country_id: 6252001
description:
[2026-06-21 09:34:00 +0000] info [cpaneld] 50.5.19.172 - trgtsjot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trgtsjot (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.14
country_id: 3469034
description:
Jun 21 09:34:25 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.190.238.115
country_id: 6252001
description:
[2026-06-21 09:35:12 +0000] info [cpaneld] 65.190.238.115 - trgtsjot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trgtsjot (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.14
country_id: 3469034
description:
Jun 21 09:34:32 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.88.216.38
country_id: 6252001
description:
[2026-06-21 09:34:39 +0000] info [cpaneld] 69.88.216.38 - trgtsjot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trgtsjot (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:09:38:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7510212&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782034715 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.147.36
country_id: 2363686
description:
[2026-06-21 09:41:02 +0000] info [webmaild] 196.168.147.36 - wiyao.g@inger.tg "POST /cpsess9364262850/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.29.192] != Current IP Address [196.168.147.36]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.46
country_id: 1269750
description:
Jun 21 09:42:08 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 1.54.56.14
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:28552.fbafrica.com||ServerName:fbafrica.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d59598a00931d7bb3a352d87e0031503659e3f26||Title:0xf5829745||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.78
country_id: 1269750
description:
Jun 21 09:42:11 ns5 auth[1229007]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.180.168
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-systeme-informatise-dinformation-sur-lenergie-au-togo-officiellement-lance/||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.166.226.186
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1876||QS:add-to-cart=1876||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.73
country_id: 1512440
description:
2026-06-21 09:48:06 H=([213.230.87.73]) [213.230.87.73]:12785 F=<corine@white-ways.com> rejected RCPT <corine@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.181.133
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-togo-accelere-son-ecosysteme-dinnovations-avec-des-initiatives-cles/||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.1.63
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/36.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:09:52:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6539158&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782035558 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.125.187.157
country_id: 3469034
description:
177.125.187.157 - - [21/Jun/2026:09:54:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266541&pdata=https%253A%252F%252Fdirect7.tg%252Fmangroves-togolaises-un-patrimoine-en-peril-une-mobilisation-en-marche&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782035675 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/mangroves-togolaises-un-patrimoine-en-peril-une-mobilisation-en-marche" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.125.187.157


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.65.139.36
country_id: 2960313
domain: 146.56.180.42:3333
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/146.56.180.42:3333/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.144.76.183
country_id: 1831722
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/52.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:10:07:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542559&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782036444 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.85.156.23
country_id: 1210997
description:
103.85.156.23 - - [21/Jun/2026:10:08:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443824&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782036481 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.85.156.23


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 157.100.88.198
country_id: 3658394
description:
157.100.88.198 - - [21/Jun/2026:10:10:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866834&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fbs-sport-9280%25252Ffifa-suspend-provisoirement-la-production-des-matchs-de-championnat%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782036612 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fbs-sport-9280%2Ffifa-suspend-provisoirement-la-production-des-matchs-de-championnat%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:157.100.88.198


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.81.121
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-16.89.124.81.121||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.44
country_id: 690791
description:
Jun 21 10:16:40 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.250.46.74
country_id: 6252001
domain: www.hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.98.21
country_id: 6252001
description:
[2026-06-21 10:20:04 +0000] info [cpaneld] 82.40.98.21 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 59.92.71.178
country_id: 1269750
description:
59.92.71.178 - - [21/Jun/2026:10:22:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053013&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782037325 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:59.92.71.178


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.116.69
country_id: 2363686
description:
[2026-06-21 10:22:54 +0000] info [cpaneld] 196.170.116.69 NEW yxhnfwxr:uTf2ZanxTUGT8iie address=196.170.116.69,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:yxhnfwxr:kw46Vzohu4DbOJRf:create_user_session,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:10:24:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065300&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782037447 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.148
country_id: 1269750
description:
Jun 21 10:24:20 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.148
country_id: 1269750
description:
Jun 21 10:24:34 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.106.226
country_id: 3469034
description:
Jun 21 10:25:58 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.106.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.232
country_id: 1269750
description:
Jun 21 10:25:32 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 176.227.240.43
country_id: 1269750
description:
[2026-06-21 10:28:12 +0000] info [cpaneld] 176.227.240.43 NEW cietg:G8NTXJUJ59rdjLsF address=176.227.240.43,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.18.88.17
country_id: 798549
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/5b5142 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.187.213.127
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/229194796 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.91.17.56
country_id: 1522867
description:
2026-06-21 10:33:06 H=([178.91.17.56]) [178.91.17.56]:4623 F=<corine@white-ways.com> rejected RCPT <corine@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.26.213.27
country_id: 2510769
description:
188.26.213.27 - - [21/Jun/2026:10:33:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183001&pdata=https%253A%252F%252Fcpanel.whereis.free.netmaster.tg%252F%253Flocale%253Dms&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782038020 HTTP/2.0" 302 0 cpanel.whereis.free.netmaster.tg "https://cpanel.whereis.free.netmaster.tg/?locale=ms" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.26.213.27


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.219.52.65
country_id: 2328926
description:
102.219.52.65 - - [21/Jun/2026:10:36:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607574&pdata=https%253A%252F%252Fcpanel.anadeb.free.netmaster.tg%252F%253Flocale%253Des&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782038193 HTTP/2.0" 302 0 cpanel.anadeb.free.netmaster.tg "https://cpanel.anadeb.free.netmaster.tg/?locale=es" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.219.52.65


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.29.36
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/ab9ea0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.0.116.109
country_id: 3469034
description:
179.0.116.109 - - [21/Jun/2026:10:39:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842469&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F04%252Fbonus-casino-canada-free-cash-upon-sign-up%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782038387 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/04/bonus-casino-canada-free-cash-upon-sign-up/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.0.116.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:10:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196843&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782038362 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.224.209.12
country_id: 3469034
description:
186.224.209.12 - - [21/Jun/2026:10:41:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9552537&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252F2025%252F11%252F10%252Fghana-le-prix-du-passeport-passe-desormais-de-26000-fcfa-a-18000-fcfa-a-compter-du-13-novembre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782038515 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/2025/11/10/ghana-le-prix-du-passeport-passe-desormais-de-26000-fcfa-a-18000-fcfa-a-compter-du-13-novembre/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.224.209.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 201.114.108.172
country_id: 3996063
description:
201.114.108.172 - - [21/Jun/2026:10:42:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302301&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-de-minamata%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782038574 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-de-minamata/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2375.1646 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:201.114.108.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.243.90
country_id: 1733045
description:
27.125.243.90 - - [21/Jun/2026:10:44:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931859&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9638&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782038678 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9638" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.7944.1979 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.243.90


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.200.250.236
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/824251386 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-21 10:45:58 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56934: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 207.102.138.19
country_id: 6251999
domain: hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/75.0.3765.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.155.220.76
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/11/18-eme-sommet-de-la-francophonie-Faure-Gnassingbe-prend-part-aux-travaux.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2022/11/18-eme-sommet-de-la-francophonie-Faure-Gnassingbe-prend-part-aux-travaux-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/11/18-eme-sommet-de-la-francophonie-Faure-Gnassingbe-prend-part-aux-travaux-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/11/18-eme-sommet-de-la-francophonie-Faure-Gnassingbe-prend-part-aux-travaux-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/11/18-eme-sommet-de-la-francophonie-Faure-Gnassingbe-prend-part-aux-travaux-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.119.177.211
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a8686a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 119.12.201.166
country_id: 6252001
domain: hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.214.194
country_id: 1733045
description:
14.192.214.194 - - [21/Jun/2026:10:53:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972568&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcooperation-togo-mali-le-prof-robert-dussey-eleve-au-rang-de-commandeur-de-lordre-national-du-mali-a-titre-etranger&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782039155 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cooperation-togo-mali-le-prof-robert-dussey-eleve-au-rang-de-commandeur-de-lordre-national-du-mali-a-titre-etranger" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.214.194


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:10:54:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998996&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782039280 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.166
country_id: 6252001
description:
[2026-06-21 10:59:47 +0000] info [cpaneld] 64.44.59.166 NEW frtwilql:nC0K6x7TdSITLUOt address=64.44.59.166,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.232.125.77
country_id: 3077311
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1101033471 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.222.72
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/7e7066 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.176.119
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1106893283 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.172
country_id: 3469034
description:
Jun 21 11:05:11 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.19.194.80
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fin-de-la-premiere-session-ordinaire-de-lannee-2023-bilan-legislatif-et-cloture-solennelle HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.30.206
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fsb-un-projet-qui-fait-battre-en-retraite-la-pauvrete HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.223.192.45
country_id: 933860
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/les-enfants-en-situation-de-vulnerabilite-et-les-meilleurs-eleves-du-canton-de-baga-ont-recu-des-kits-scolaires HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.245.86.21
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-a-celebre-son-jubile-de-diamant HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.228.229
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-taux-daccessibilite-aux-soins-de-sante-passe-a-907-en-2023/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:11:10:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168868&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782040197 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.211.13
country_id: 1512440
description:
2026-06-21 11:09:47 H=([37.110.211.13]) [37.110.211.13]:23357 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.98.118
country_id: 1819730
description:
2026-06-21 11:10:46 dovecot_plain authenticator failed for H=(k54fjd2v211rvt160ts09m) [47.82.98.118]:53969: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.89.31.65
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/shelter-afrique-devient-shafdb/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.82.98.118
country_id: 1819730
description:
Jun 21 11:10:44 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.82.98.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.84.145
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/securite-alimentaire-en-afrique-le-groupe-ocp-consacrera-4-millions-de-tonnes-dengrais-en-2023/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-21 11:12:06 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50916: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:12:27 +0000] info [cpaneld] 157.66.56.231 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.136.194.47
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/shelter-afrique-devient-shafdb/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 21 11:12:00 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 21 11:12:08 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 197.239.10.63
country_id: 226074
description:
[2026-06-21 11:13:51 +0000] info [cpaneld] 197.239.10.63 - pnls "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 197.239.10.63
country_id: 226074
description:
[2026-06-21 11:13:55 +0000] info [cpaneld] 197.239.10.63 NEW pnls:NpkWt_w3mkieitkF address=197.239.10.63,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.130.101.151
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1475||QS:add-to-cart=1475||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.202.249
country_id: 3017382
domain: yoto2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:140.99.202.249||TA:140.99.202.249||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.100.179.4
country_id: 1880251
description:
101.100.179.4 - - [21/Jun/2026:11:17:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405785&pdata=http%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782040641 HTTP/1.1" 302 0 c2ie.tg "http://c2ie.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.100.179.4


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.125.253
country_id: 6252001
domain: yoto2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:23.229.125.253||TA:23.229.125.253||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.184.91
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/kpalime-les-lignes-des-activites-gouvernementales/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.38.191
country_id: 2542007
description:
2026-06-21 11:17:53 dovecot_plain authenticator failed for H=adsl196-191-38-206-196.adsl196-2.iam.net.ma (3ex9pxce9dzq9u2ul2olion8) [196.206.38.191]:35503: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.250.205.170
country_id: 3144096
domain: agou1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.250.205.170||TA:104.250.205.170||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.202.223
country_id: 3190538
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:209.242.202.223||TA:209.242.202.223||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.206.38.191
country_id: 2542007
description:
Jun 21 11:17:51 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.206.38.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-21 11:19:01 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55908: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.226.205.16
country_id: 2750405
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:185.226.205.16||TA:185.226.205.16||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.187.95
country_id: 2077456
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:202.155.187.95||TA:202.155.187.95||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.167.210
country_id: 6252001
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:217.117.167.210||TA:217.117.167.210||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:19:46 +0000] info [cpaneld] 157.66.56.231 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.122.13
country_id: 2635167
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:198.105.122.13||TA:198.105.122.13||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.104.132
country_id: 6252001
domain: ave2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.239.104.132||TA:104.239.104.132||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-21 11:21:04 +0000] info [cpaneld] 5.230.133.152 NEW wgqhqbem:wA_6ihredxC4TiVX address=5.230.133.152,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.70.91.26
country_id: 2542007
description:
196.70.91.26 - - [21/Jun/2026:11:22:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7445360&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14199&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782040972 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14199" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.8077.1030 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.70.91.26


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-21 11:24:09 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55748: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:11:25:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132936&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041110 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:26:41 +0000] info [cpaneld] 157.66.56.231 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.244.154.237
country_id: 99237
description:
185.244.154.237 - - [21/Jun/2026:11:26:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842053&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14199&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041208 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14199" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.1192.1458 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.244.154.237


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.99.91.0
country_id: 1643084
description:
[2026-06-21 11:28:42 +0000] info [cpaneld] 118.99.91.0 - cietg "POST /cpsess6197878708/execute/Fileman/list_files HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [176.227.240.43] != Current IP Address [118.99.91.0]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 118.99.91.0
country_id: 1643084
description:
[2026-06-21 11:29:04 +0000] info [cpaneld] 118.99.91.0 NEW cietg:D8voZxpTmgtDeChh address=118.99.91.0,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.104.36.188
country_id: 3865483
description:
190.104.36.188 - - [21/Jun/2026:11:31:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999982&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-developpement-a-la-base-saccelere-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041463 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-developpement-a-la-base-saccelere-au-togo/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2867.1405 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.104.36.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.145.217.195
country_id: 1733045
description:
175.145.217.195 - - [21/Jun/2026:11:30:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171949&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-25-000-latrines-erigees-pour-ameliorer-la-vie-des-communautes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041429 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-25-000-latrines-erigees-pour-ameliorer-la-vie-des-communautes/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.3251.1924 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.145.217.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.121.80
country_id: 6252001
description:
[2026-06-21 11:32:30 +0000] info [cpaneld] 82.40.121.80 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.199.60.176
country_id: 1880251
description:
[2026-06-21 11:34:13 +0000] info [cpaneld] 138.199.60.176 - cietg "POST /cpsess3638967900/execute/Fileman/list_files HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [118.99.91.0] != Current IP Address [138.199.60.176]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.87.67.11
country_id: 1643084
description:
103.87.67.11 - - [21/Jun/2026:11:35:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134492&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041703 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.87.67.11


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.226.79.60
country_id: 3996063
description:
177.226.79.60 - - [21/Jun/2026:11:34:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6971758&pdata=https%253A%252F%252Fcaissederetraites.tg%252Fpages%252Fdisplay%252Forganigramme-et-fonctionnement&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041677 HTTP/2.0" 302 0 caissederetraites.tg "https://caissederetraites.tg/pages/display/organigramme-et-fonctionnement" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.226.79.60


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.150.86
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/716a59 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.61.240.61
country_id: 1210997
description:
103.61.240.61 - - [21/Jun/2026:11:39:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908102&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F22432&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041955 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/22432" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.61.240.61


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.141.221
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/faure-essozimna-gnassingbe-trace-la-vision-du-togo-pour-2031 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.100.179.4
country_id: 1880251
description:
101.100.179.4 - - [21/Jun/2026:11:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195858&pdata=https%253A%252F%252Fc2ie.tg%252F%2526lt%253B%252Fa%2526gt%253B&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041976 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/&lt;/a&gt;" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.100.179.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:11:39:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182190&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782041977 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 65.110.40.95
country_id: 6252001
domain: mail.auditeccandco.com
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/debug.log||WPU:||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.182.199.104
country_id: 2963597
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/transformation-numerique-au-togo-lacces-aux-donnees-publiques-democratise HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.121.143.53
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/le-togo-tient-les-promesses-envers-les-personnes-agees/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.110.40.95
country_id: 6252001
domain: mail.auditeccandco.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/debug.log||User:pjwfvzan||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.181.183
country_id: 6252001
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:191.101.181.183||TA:191.101.181.183||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:42:02 +0000] info [cpaneld] 157.66.56.231 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.50.119
country_id: 6252001
domain: yoto2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.238.50.119||TA:104.238.50.119||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.104.210
country_id: 6252001
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.239.104.210||TA:104.239.104.210||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.163.182
country_id: 6252001
domain: yoto2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:107.172.163.182||TA:107.172.163.182||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.45.123.112
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-filiere-rizicole-pourvoyeuse-de-314-000-emplois HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.164.76
country_id: 6252001
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:217.117.164.76||TA:217.117.164.76||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.209.57.174
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/98a8b7 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.255.45.83
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/can-2021-prudential-signe-un-contrat-de-sponsoring-avec-la-caf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.95.189.244
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-grandes-decisions-du-conseil-des-ministres-du-vendredi-19-novembre-2021 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.98.77.129
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/faure-gnassingbe-et-dr-akinwumi-adesina-echangent-sur-les-perspectives-du-partenariat-togo-bad HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.250.116
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.140.250.116||TA:45.140.250.116||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:47:51 +0000] info [cpaneld] 157.66.56.231 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [21/Jun/2026:11:49:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051882&pdata=https%253A%252F%252F154.70.82.244&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782042554 HTTP/2.0" 302 0 154.70.82.244 "https://154.70.82.244/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.159.12
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/elections-legislatives-et-regionales-au-togo-demarrage-effectif-de-la-campagne-ce-13-avril-2024 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.52.14
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/veme-republique-quest-ce-qui-motive-le-choix-de-jean-lucien-kwassi-lanyo-savi-de-tove-un-homme-de-86-ans-au-poste-du-pr HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:50:32 +0000] info [cpaneld] 157.66.56.231 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.200.31.253
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/opportunites-dinvestissement-lome-accueille-lafrica-executing-meeting-2023 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.129.8
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/2615 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:11:55:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117531&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782042903 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.137.55.54
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-pari-gagne-pour-le-ppaao-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.45.55.54
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/youth-for-youth-sandra-ablamba-johnson-invite-la-jeunesse-togolaise-a-faire-siennes-les-nobles-valeurs-de-patriotisme-de-participation-citoyenne-dexcellence-et-dhumilite HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.46.28
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/paiement-de-la-tpu-les-controles-demarrent-le-02-mai-prochain/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:56:51 +0000] info [cpaneld] 157.66.56.231 - lanuitdescouleurs31 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lanuitdescouleurs31 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.93
country_id: 3469034
description:
Jun 21 11:57:29 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.93
country_id: 3469034
description:
Jun 21 11:57:37 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.61
country_id: 3469034
description:
Jun 21 11:57:46 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.124.175.247
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-grandes-lignes-du-conseil-des-ministres-du-09-avril-2024/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.115.99
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-liste-des-pharmacies-de-garde-de-la-semaine-du-12-au-19-septembre-2022/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:57:49 +0000] info [cpaneld] 157.66.56.231 - oegrazwu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user oegrazwu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:59:19 +0000] info [cpaneld] 157.66.56.231 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 11:59:37 +0000] info [cpaneld] 157.66.56.231 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.57.171.41
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lengagement-du-togo-pour-linclusion-des-filles-dans-la-formation-technique-et-professionnelle HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.236.174
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/paiement-des-impots-et-taxes-la-dematerialisation-des-processus-de-paiement/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.206.230
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/elections-generales-au-nigeria-johaness-makouvia-chef-mission-dobservation-de-ipcsl-pose-ses-valises-a-abuja HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.98.158
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/feuille-de-route-gouvernementale-une-ambition-affirmee-des-resultats-concrets HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.77.17
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cote-divoire-amadou-gon-coulibaly-est-mort HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.162.136.23
country_id: 1168579
description:
103.162.136.23 - - [21/Jun/2026:12:00:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121580&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782043233 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.162.136.23


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.217.247.107
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/696e6e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 12:04:30 +0000] info [cpaneld] 157.66.56.231 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.176.81.8
country_id: 1210997
description:
103.176.81.8 - - [21/Jun/2026:12:04:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316442&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-lancement-des-travaux-de-construction-des-travaux-de-la-centrale-photovoltaique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782043481 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-lancement-des-travaux-de-construction-des-travaux-de-la-centrale-photovoltaique/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.1936.1949 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.176.81.8


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-21 12:08:14 +0000] info [whostmgrd] 103.77.107.71 - cp909049p23 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-21 12:07:43 +0000] info [cpaneld] 157.66.56.231 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:12:08:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12895899&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782043724 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.44.88.4
country_id: 798544
description:
191.44.88.4 - - [21/Jun/2026:12:10:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038875&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782043837 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.44.88.4


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.55
country_id: 690791
description:
2026-06-21 12:11:32 H=([77.83.39.55]) [77.83.39.55]:63633 F=<info@elsolut.com> rejected RCPT <contact@sthandling-aero.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [21/Jun/2026:12:11:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459759&pdata=http%253A%252F%252Fwww.pnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782043903 HTTP/1.1" 302 0 www.pnls.tg "http://www.pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.134.216.53
country_id: 1282988
description:
103.134.216.53 - - [21/Jun/2026:12:13:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907498&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fle-secret-du-nouvel-ordre-mondial-la-verite%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044010 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Fle-secret-du-nouvel-ordre-mondial-la-verite%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.134.216.53


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-21 12:14:23 +0000] info [whostmgrd] 103.77.107.71 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.210.155.21
country_id: 226074
description:
41.210.155.21 - - [21/Jun/2026:12:13:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710424&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F18%252Fhommages-a-togbu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044030 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/18/hommages-a-togbu/" "Mozilla/5.0 (Android 15; Mobile; rv:151.0) Gecko/151.0 Firefox/151.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.210.155.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.34.138.220
country_id: 1168579
description:
2026-06-21 12:15:25 dovecot_plain authenticator failed for H=(DESKTOP-ERVLA54) [39.34.138.220]:36129: 535 Incorrect authentication data (set_id=turbolte@mafisteel.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.96.106.50
country_id: 6252001
description:
[2026-06-21 12:15:29 +0000] info [cpaneld] 20.96.106.50 - cpsess7727697097frontendpaper_lanternwp-toolkitindex.live.php "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.255.184.254
country_id: 290291
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/02/M.-Hann-avec-le-ministre-togolais-de-lhabitat-du-d\xc3\xa9veloppement-urbain-et-de-la-r\xc3\xa9forme-fonci\xc3\xa8re-M.-Koffi-Tsolenyanou..jpg 2048w, http:/togodailynews.tg/wp-content/uploads/2023/02/M.-Hann-avec-le-ministre-togolais-de-lhabitat-du-d\xc3\xa9veloppement-urbain-et-de-la-r\xc3\xa9forme-fonci\xc3\xa8re-M.-Koffi-Tsolenyanou.-300x199.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/02/M.-Hann-avec-le-ministre-togolais-de-lhabitat-du-d\xc3\xa9veloppement-urbain-et-de-la-r\xc3\xa9forme-fonci\xc3\xa8re-M.-Koffi-Tsolenyanou.-768x509.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/02/M.-Hann-avec-le-ministre-togolais-de-lhabitat-du-d\xc3\xa9veloppement-urbain-et-de-la-r\xc3\xa9forme-fonci\xc3\xa8re-M.-Koffi-Tsolenyanou.-1024x678.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.34.138.220
country_id: 1168579
description:
2026-06-21 12:17:22 dovecot_plain authenticator failed for H=(DESKTOP-ERVLA54) [39.34.138.220]:36649: 535 Incorrect authentication data (set_id=turbolte@mafisteel.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.34.138.220
country_id: 1168579
description:
2026-06-21 12:17:35 dovecot_plain authenticator failed for H=(DESKTOP-ERVLA54) [39.34.138.220]:36779: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.212.108
country_id: 1733045
description:
113.211.212.108 - - [21/Jun/2026:12:18:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998747&pdata=https%253A%252F%252Ftogodailynews.tg%252Freboisement-le-defi-crucial-du-suivi-et-de-lentretien-des-plants-apres-la-plantation%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044291 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/reboisement-le-defi-crucial-du-suivi-et-de-lentretien-des-plants-apres-la-plantation/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.212.108


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.86.218.104
country_id: 2510769
description:
85.86.218.104 - - [21/Jun/2026:12:20:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080989&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252F2025%252F11%252F10%252Fghana-le-prix-du-passeport-passe-desormais-de-26000-fcfa-a-18000-fcfa-a-compter-du-13-novembre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044448 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/2025/11/10/ghana-le-prix-du-passeport-passe-desormais-de-26000-fcfa-a-18000-fcfa-a-compter-du-13-novembre/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.86.218.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.193.134.54
country_id: 3469034
description:
186.193.134.54 - - [21/Jun/2026:12:21:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118086&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12496&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044491 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12496" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.9110.1631 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.193.134.54


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.166.66
country_id: 6252001
domain: ave2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:217.117.166.66||TA:217.117.166.66||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.174.68.235
country_id: 1282988
description:
103.174.68.235 - - [21/Jun/2026:12:25:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999204&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Fcovid-19-la-boad-va-decaisser-15-milliards-pour-chacun-des-pays-membres-dont-le-togo%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044725 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/economie/covid-19-la-boad-va-decaisser-15-milliards-pour-chacun-des-pays-membres-dont-le-togo/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.174.68.235


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.70.217
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/59504b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:12:24:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984293&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044683 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.19.39.185
country_id: 1643084
description:
154.19.39.185 - - [21/Jun/2026:12:25:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263450&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Frgph-5-pour-se-faire-recenser-appelez-ces-numeros%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044736 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Frgph-5-pour-se-faire-recenser-appelez-ces-numeros%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.19.39.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.87.67.11
country_id: 1643084
description:
103.87.67.11 - - [21/Jun/2026:12:27:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13132904&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782044823 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.87.67.11


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.98.86.174
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9f9798 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.19.140.205
country_id: 174982
description:
[2026-06-21 12:32:15 +0000] info [webmaild] 146.19.140.205 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-21 12:35:48 +0000] info [whostmgrd] 103.77.107.71 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350553
name: IM360 WAF: Drupalgeddon test (CVE-2018-7602)
abuser: 64.204.13.52
country_id: 1210997
domain: fbafrica.com
description:
IM360 WAF: Drupalgeddon test (CVE-2018-7602)||MVN:ARGS_NAMES:\\x9d\\xf7\\x9d\\xbf\\x941\\xd9\\tB\\xfb\\xe21O\\xb3<\\xde\\x00>`\\x81\\x94\\xbd\\x96\\xe4\\xbb\\xda6\\xef%\\xc1,\\\\YK\\xaaj\\xaf\\x814\\bX\\xaf|M\\xd3b a\\xb3\\x1f\\x1b\\xd0\\x91\\xa1\\xbb\\xc6,\\x910\\x94\\xd0.@-\\xf1\\x9c\\xf7\\xb7\\xe3\\xb4{\\x94\\xce\\xd5*\\xd0\\x02<\\x95<e\\xaa\\xfc\\xf9x\\x0f\\\\\\xd3\\xbd\\x05\\x04\\xfa\\x89u\\xfe\\x8b\\xe2\\xf0\\x97z[\\xc0\\x8f\\x8b\\xe6\\xa4\\xe5\\xd2\\x93%s{\\xb0}\\xad!\\xad\\xe2W}\\x8f]4\\xfak!q\\xdc\\xeeq\\xd8\\xfc\\xc3:\\xeb\\x81\"ZGY\\x01gD\\xb1\\xb4tj\\xc4A\\xad2\\xff~\\xbe6<\\x99\\xaf\\xbb\\xb1\\xd6\\n\\x0f\\xf5Z\\xe9\\xaf\\xa2\\x00P\\xd6Q z\\xd6W\\xeba\\xbe\\x1e\\xcaM\\xf2\\xb9\\xbe$2\\xdf\\xb7\\xdb\\x8f\\x90D\\xc0\"x\\x05\\xee\\xe3^\\x1c\\xdc\\xdb\\x81;\\x1b\\xe6\\xc4\\xc83\\xb9;\\xa4\\xa7\\xa1c\\x15\\xc1\\x91\\xa0\\x0f\\xe30\\xfb\\xf6\\x01g\\xab\\xc2v\\x94J\\x81q\\x1e\\\\'!\\x9a'\\x00\\xab\\x8do\\xf8\\x1f\\xec\\xbf\\x90\\xcc\\x04\\xec\\xf5\\t}~\\xd0iZ\\xfb\\xbc\\xc0\\xd3:\\x87z\\xdfo\\xe4\\xbd\\no\\xeaiN\\xcfF\\xd2\\xc8\\x86\\xa6\\xe8Ic%\\xae\\xbc\\xac\\x851F7~$\\x83||MV:\x9d\xf7\x9d\xbf\x941\xd9\tB\xfb\xe21O\xb3<\xde\x00>`\x81\x94\xbd\x96\xe4\xbb\xda6\xef%\xc1,\\YK\xaaj\xaf\x814\bX\xaf|M\xd3b a\xb3\x1f\x1b\xd0\x91\xa1\xbb\xc6,\x910\x94\xd0.@-\xf1\x9c\xf7\xb7\xe3\xb4{\x94\xce\xd5*\xd0\x02<\x95<e\xaa\xfc\xf9x\x0f\\\xd3\xbd\x05\x04\xfa\x89u\xfe\x8b\xe2\xf0\x97z[\xc0\x8f\x8b\xe6\xa4\xe5\xd2\x93%s{\xb0}\xad!\xad\xe2W}\x8f]4\xfak!q\xdc\xeeq\xd8\xfc\xc3:\xeb\x81\"ZGY\x01gD\xb1\xb4tj\xc4A\xad2\xff~\xbe6<\x99\xaf\xbb\xb1\xd6\n\x0f\xf5Z\xe9\xaf\xa2\x00P\xd6Q z\xd6W\xeba\xbe\x1e\xcaM\xf2\xb9\xbe$2\xdf\xb7\xdb\x8f\x90D\xc0\"x\x05\xee\xe3^\x1c\xdc\xdb\x81;\x1b\xe6\xc4\xc83\xb9;\xa4\xa7\xa1c\x15\xc1\x91\xa0\x0f\xe30\xfb\xf6\x01g\xab\xc2v\x94J\x81q\x1e\\'!\x9a'\x00\xab\x8do\xf8\x1f\xec\xbf\x90\xcc\x04\xec\xf5\t}~\xd0iZ\xfb\xbc\xc0\xd3:\x87z\xdfo\xe4\xbd\no\xeaiN\xcfF\xd2\xc8\x86\xa6\xe8Ic%\xae\xbc\xac\x851F7~$\x83||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 36.64.119.114
country_id: 1643084
description:
36.64.119.114 - - [21/Jun/2026:12:37:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117736&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782045454 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:36.64.119.114


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.21.203.9
country_id: 3865483
description:
181.21.203.9 - - [21/Jun/2026:12:38:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395083&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782045523 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.21.203.9


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.52.66.25
country_id: 1605651
description:
182.52.66.25 - - [21/Jun/2026:12:39:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526620&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782045540 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.52.66.25


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.142.131
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/Johan_A._Mistiaen.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/02/Johan_A._Mistiaen-300x172.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/Johan_A._Mistiaen-768x441.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-21 12:40:01 +0000] info [whostmgrd] 103.77.107.71 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:12:40:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314028&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782045651 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.142
country_id: 3469034
description:
2026-06-21 12:42:33 dovecot_login authenticator failed for H=([199.229.254.131]) [189.113.185.142]:39258: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.17.197
country_id: 6252001
description:
Jun 21 12:42:54 ns5 pure-ftpd[1560690]: (?@45.38.17.197) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.23.230.90
country_id: 1733045
description:
113.23.230.90 - - [21/Jun/2026:12:43:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908615&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782045811 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.23.230.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.0.25.36
country_id: 192950
description:
102.0.25.36 - - [21/Jun/2026:12:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367786&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782046133 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.0.25.36


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.213.179.25
country_id: 192950
description:
102.213.179.25 - - [21/Jun/2026:12:48:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6394523&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782046131 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.213.179.25


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.114.97.151
country_id: 1210997
description:
103.114.97.151 - - [21/Jun/2026:12:48:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211592&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782046131 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.114.97.151


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.180.226
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/doufelgou-delivrance-rapide-des-cartes-didentite-pendant-sintu-janjaagu/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.23.230.90
country_id: 1733045
description:
113.23.230.90 - - [21/Jun/2026:12:53:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816473&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782046421 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.23.230.90


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.12.223
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b2a28c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 212.252.79.165
country_id: 298795
domain: dany2.mairie.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.19||T:APACHE||SC:/home/czqxxxnu/public_html/wp-admin/admin-ajax.php||User:czqxxxnu||WPU:||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.149.89
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/les-portes-des-ecoles-maarif-souvrent-au-togo/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:12:56:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872342&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782046591 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 94.204.36.238
country_id: 290557
description:
94.204.36.238 - - [21/Jun/2026:12:56:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739160&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fhanna-serwaa-tetteh-nommee-cheffe-du-bureau-des-nations-unies-aupres-de-lunion-africaine&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782046597 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/international/hanna-serwaa-tetteh-nommee-cheffe-du-bureau-des-nations-unies-aupres-de-lunion-africaine" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:94.204.36.238


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.162.218
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afreximbank-organise-une-tournee-de-financement-au-liberia-pour-stimuler-le-commerce-et-linvestissement HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.245.202
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/04/IMG-20220421-WA0110.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2022/04/IMG-20220421-WA0110-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/04/IMG-20220421-WA0110-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/04/IMG-20220421-WA0110-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/04/IMG-20220421-WA0110-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.6.251
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/blocfx-une-banque-numerique-innovante-basee-a-dubai HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.36.223.117
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-portee-des-postes-de-peage-au-togo/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.182.146.211
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lassociation-les-amis-de-charles-abalo-awade-aca-en-action-de-proximite HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.137.184
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/projet-waca-le-premier-ministre-lance-les-travaux-de-protection-cotiere HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.248.245.142
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/agro-industrie-le-togo-obtient-un-financement-de-389-millions-de-la-bad/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.72.20
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-croissance-economique-attendue-a-62-en-2025 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.93.112.145
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/1902 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.97.92
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afreximbank-et-ecobank-sassocient-pour-simplifier-le-commerce-et-la-conformite-des-entreprises-africaines HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.53.251.26
country_id: 630336
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/promotion-de-laquaculture-au-togo-edem-kokou-tengue-remet-des-cages-flottantes-aux-diplomes-de-lifad-aquaculture-de-elavagnon HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.188.12.73
country_id: 1733045
description:
202.188.12.73 - - [21/Jun/2026:13:01:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081705&pdata=https%253A%252F%252Fwebmail.oliane.free.netmaster.tg%252F%253Flocale%253Dfi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782046897 HTTP/2.0" 302 0 webmail.oliane.free.netmaster.tg "https://webmail.oliane.free.netmaster.tg/?locale=fi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.188.12.73


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lac&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.84.51.87
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/827b53 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.233.251.223
country_id: 1269750
description:
2026-06-21 13:04:30 dovecot_plain authenticator failed for H=ec2-13-233-251-223.ap-south-1.compute.amazonaws.com (EC2AMAZ-4DSRFT9.ap-south-1.compute.internal) [13.233.251.223]:49797: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [21/Jun/2026:13:05:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263193&pdata=http%253A%252F%252F154.70.82.244%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782047115 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.233.251.223
country_id: 1269750
description:
2026-06-21 13:04:36 dovecot_login authenticator failed for H=ec2-13-233-251-223.ap-south-1.compute.amazonaws.com (EC2AMAZ-4DSRFT9.ap-south-1.compute.internal) [13.233.251.223]:49797: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.103
country_id: 3469034
description:
Jun 21 13:05:59 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.56.58
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/797979 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [21/Jun/2026:13:05:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7521135&pdata=http%253A%252F%252F154.70.82.244%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782047122 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.86.56.179
country_id: 1282988
description:
103.86.56.179 - - [21/Jun/2026:13:08:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736067&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F51803&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782047278 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/51803" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.86.56.179


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.185.211.232
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/900617493 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 130.254.112.74
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:130.254.112.74||TA:130.254.112.74||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.22.71
country_id: 2921044
description:
[2026-06-21 13:08:53 +0000] info [cpaneld] 195.63.22.71 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jun 21 13:09:16 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-21 13:09:32 +0000] info [cpaneld] 103.77.107.71 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.0.19
country_id: 3469034
description:
Jun 21 13:09:43 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.0.19 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:13:11:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367321&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782047472 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-21 13:11:24 +0000] info [cpaneld] 195.3.220.88 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.126.188
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/IMG-20251003-WA0045.webp 1080w, http:/togodailynews.tg/wp-content/uploads/2025/10/IMG-20251003-WA0045-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/IMG-20251003-WA0045-1024x682.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/10/IMG-20251003-WA0045-768x511.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
country_id: 290557
description:
Jun 21 13:12:15 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-21 13:12:21 +0000] info [cpaneld] 195.3.220.88 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.222.97
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/2711 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.176.229.4
country_id: 1282988
description:
103.176.229.4 - - [21/Jun/2026:13:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050390&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Fcndh-nakpa-polo-a-pris-fonction%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782047743 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Fcndh-nakpa-polo-a-pris-fonction%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.176.229.4


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.167.25
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/05/Le-chef-de-lEtat-a-assiste-a-la-mise-en-service-dune-raffinerie-a-Lagos.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2023/05/Le-chef-de-lEtat-a-assiste-a-la-mise-en-service-dune-raffinerie-a-Lagos-300x237.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/05/Le-chef-de-lEtat-a-assiste-a-la-mise-en-service-dune-raffinerie-a-Lagos-768x608.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.22.212.32
country_id: 1269750
description:
2026-06-21 13:16:59 dovecot_login authenticator failed for H=mail.standforland.in [165.22.212.32]:43694: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-21 13:19:16 +0000] info [whostmgrd] 103.77.107.71 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.100.81
country_id: 6252001
description:
[2026-06-21 13:20:15 +0000] info [cpaneld] 82.40.100.81 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.42.120.25
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/827b77 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.204.213
country_id: 6252001
description:
[2026-06-21 13:22:18 +0000] info [cpaneld] 23.83.204.213 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.98
country_id: 2750405
description:
192.42.116.98 - ecukpqcm [21/Jun/2026:13:22:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081031&pdata=https%253A%252F%252Ftogomedia24.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782048144 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.98


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.150.32.21
country_id: 3865483
description:
170.150.32.21 - - [21/Jun/2026:13:25:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818323&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dkako-nubukpo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782048315 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?tag=kako-nubukpo" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.9842.1011 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.150.32.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:13:26:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261863&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782048358 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.255.107.33
country_id: 1643084
description:
101.255.107.33 - - [21/Jun/2026:13:26:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661332&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782048416 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.255.107.33


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.183.114
country_id: 1831722
description:
[2026-06-21 13:33:05 +0000] info [cpaneld] 103.164.183.114 NEW ecukpqcm:80I6jT9CeC1wsgtv address=103.164.183.114,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.96
country_id: 3175395
description:
209.227.239.96 - - [21/Jun/2026:13:33:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922244&pdata=https%253A%252F%252Ftogointerim.net%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782048836 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.96


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.135.48.38
country_id: 6252001
description:
[2026-06-21 13:35:02 +0000] info [cpaneld] 146.135.48.38 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.160.207.67
country_id: 6252001
description:
[2026-06-21 13:35:16 +0000] info [cpaneld] 108.160.207.67 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.77.218.239
country_id: 3017382
description:
[2026-06-21 13:35:20 +0000] info [cpaneld] 51.77.218.239 NEW wcnyaruu:ytYCly2wlh85S6Rx address=51.77.218.239,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.54.141.210
country_id: 6252001
description:
[2026-06-21 13:35:46 +0000] info [cpaneld] 69.54.141.210 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.71.214.155
country_id: 6252001
description:
Jun 21 13:36:03 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.71.214.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2026-06-21 13:36:05 dovecot_login authenticator failed for H=wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:61789: 535 Incorrect authentication data (set_id=info@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.27.65
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/renforcement-du-partenariat-bilateral-entre-le-togo-et-le-rwanda-des-perspectives-prometteuses HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-21 13:41:03 +0000] info [cpaneld] 5.230.133.117 NEW sodigaz:TMQL86U7vNIIAGdv address=5.230.133.117,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:13:41:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119064&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782049263 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.228.128.220
country_id: 1831722
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/marche-financier-regional-le-togo-mobilise-275-milliards-fcfa HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.141.19.113
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/2207 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.132.48
country_id: 719819
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-voici-la-liste-complete-des-membres-du-nouveau-gouvernement/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.97.188
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/elections-municipales-la-fosem-2025-demarre-ses-activites HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.120.72.113
country_id: 3469034
description:
2026-06-21 13:44:33 dovecot_login authenticator failed for H=(187-120-72-113.pso-fb.mastercabo.com.br) [187.120.72.113]:49228: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.47.16.59
country_id: 3686110
description:
[2026-06-21 13:44:30 +0000] info [cpaneld] 154.47.16.59 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.113
country_id: 3469034
description:
Jun 21 13:44:31 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.47.16.59
country_id: 3686110
description:
[2026-06-21 13:46:06 +0000] info [cpaneld] 154.47.16.59 - amedekabenoit@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.213.132
country_id: 1733045
description:
14.192.213.132 - - [21/Jun/2026:13:46:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871835&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-un-arsenal-reglementaire-pour-proteger-les-ressources-forestieres%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782049574 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-un-arsenal-reglementaire-pour-proteger-les-ressources-forestieres/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.213.132


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.137.68.236
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fin-de-la-premiere-session-ordinaire-de-lannee-2023-bilan-legislatif-et-cloture-solennelle/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.47.16.59
country_id: 3686110
description:
[2026-06-21 13:46:34 +0000] info [cpaneld] 154.47.16.59 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.122.73.61
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/notation-financiere-sp-global-ratings-accorde-a-afreximbank-la-note-dinvestissement-bbb-a-2/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 94.204.24.37
country_id: 290557
description:
94.204.24.37 - - [21/Jun/2026:13:48:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13395605&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Fvideo-parole-a-dr-badombena-wanta-dimiline-pharmacienne-dofficine-2%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782049694 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Fvideo-parole-a-dr-badombena-wanta-dimiline-pharmacienne-dofficine-2%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:94.204.24.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-21 13:48:34 +0000] info [cpaneld] 195.3.220.88 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.179.102.174
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-dernier-hommage-a-patrick-tevi-benissan HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.61.122.26
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afreximbank-inaugure-le-premier-centre-commercial-africain-du-genre-a-abuja HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.209.221.171
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/feg-champion-de-la-petite-enfance-selon-lunicef/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.191.129.158
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/mecanisation-agricole-au-togo-lancement-dun-programme-novateur-de-formation HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.39.31
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/diplomatie-vers-louverture-dune-ambassade-du-togo-a-niamey HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.155.177.226
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1220866937 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.255.196.7
country_id: 99237
description:
149.255.196.7 - - [21/Jun/2026:13:51:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13344197&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9305&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782049858 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9305" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.255.196.7


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.113.87.211
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/scolarite-au-togo/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.77.183
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/togo-voici-la-liste-complete-des-membres-du-nouveau-gouvernement/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.52.240.138
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-bidc-obtient-laccreditation-du-fonds-vert-pour-le-climat/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.254.83.82
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/rassembler-proteger-transformer-le-triptyque-togolais/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-21 13:53:59 +0000] info [cpaneld] 195.3.220.88 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.205.158
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/73531606 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.35.225.197
country_id: 3996063
description:
2026-06-21 13:53:37 dovecot_login authenticator failed for H=(tacambaro.tecnm.mx) [38.35.225.197]:40060: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.86.3
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/climat-des-affaires-le-togo-a-le-vent-en-poupe/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.220.168
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/grand-meeting-damoutieve-le-parti-unir-mobilise-les-populations-a-plebisciter-leurs-listes/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.123.20
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=19285 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.118.55
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/que-retenir-des-elections-locales-du-30-juin-2019 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.104.180
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/agro-industrie-le-togo-obtient-un-financement-de-389-millions-de-la-bad/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.68.78.57
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-report-de-la-date-des-elections-senatoriales HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.85.26
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-grandes-decisions-du-conseil-des-ministres-du-1er-avril-2026 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-21 13:55:50 +0000] info [cpaneld] 195.3.220.88 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.16.240.187
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/la-bidc-signe-un-accord-avec-la-nosi-pour-lhebergement-du-premier-site-de-repli-de-la-banque/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.8.52
country_id: 798544
description:
Jun 21 13:56:54 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.8.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.74.239.161
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/la-bidc-accorde-un-pret-de-20-millions-deuros-pour-soutenir-les-pme-pmi-en-guinee/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.223.220
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/forum-maritimafrica-week-les-acteurs-maritimes-en-conclave-a-lome/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.72.233.241
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/meurtre-dune-dame-a-cacaveli-la-gendarmerie-interpelle-le-presume-auteur HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.133.206.53
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/victoire-tomegah-dogbe-inaugure-lusine-textile-benart-afrique-a-datcha/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.70.132
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/yawa-kouigan-au-contact-direct-des-equipes-redactionnelles/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.140.252
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-2025-annee-determinant-dans-la-politique-dinvestissement HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.71.121.182
country_id: 1562822
description:
27.71.121.182 - - [21/Jun/2026:14:00:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130588&pdata=https%253A%252F%252Ftogodailynews.tg%252Famelioration-du-systeme-de-sante-fatoumata-binta-diallo-felicite-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782050399 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/amelioration-du-systeme-de-sante-fatoumata-binta-diallo-felicite-faure-gnassingbe/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.71.121.182


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.7.13.62
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/16112 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.94.255.223
country_id: 1282988
description:
103.94.255.223 - - [21/Jun/2026:14:02:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248797&pdata=https%253A%252F%252F24heureinfo.tg%252Fjustice%252Ftogo-des-condamnations-apres-linterpellation-du-journaliste-ketohou-dans-laffaire-de-cuilleres-dorees%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782050536 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/justice/togo-des-condamnations-apres-linterpellation-du-journaliste-ketohou-dans-laffaire-de-cuilleres-dorees/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.94.255.223


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.197.49
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/conseil-national-du-credit-badanam-patoki-banques-tpme HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.176.132
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/les-grandes-decisions-du-conseil-des-ministres-du-04-novembre-2020 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-21 14:03:02 +0000] info [cpaneld] 195.3.220.88 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.91.175.98
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/le-togo-optimise-son-budget-et-stimule-le-bien-etre-de-ses-citoyens/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.91.52.5
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/sante-namon-dispose-dun-nouveau-cms/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.32.190.174
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-une-nouvelle-etape-pour-laccompagnement-entrepreneurial-des-jeunes HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.249.228
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-06.45.140.249.228||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.251.197
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-06.45.140.251.197||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.248.3
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-05.45.140.248.3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.173.146.9
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/1570 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.250.56
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-06.45.140.250.56||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.251.113
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-07.45.140.251.113||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.93.241
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lindemnisation-des-victimes-sociopolitiques-gage-du-vivre-ensemble-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 130.193.231.94
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/exposition-universelle-2025-au-japon-le-togo-en-operation-de-charme/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.5.196.32
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=8977 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.249.177
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-08.45.140.249.177||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.250.143
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-07.45.140.250.143||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.117.175.200
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/electricite-programme-des-interruptions-de-cette-semaine-et-les-zones-concernees/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.51.92.124
country_id: 1282988
description:
202.51.92.124 - - [21/Jun/2026:14:08:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395801&pdata=http%253A%252F%252Ftogodailynews.tg%252Fyouth-for-youth-sandra-ablamba-johnson-invite-la-jeunesse-togolaise-a-faire-siennes-les-nobles-valeurs-de-patriotisme-de-participation-citoyenne-dexcellence-et-dhumilite&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782050913 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/youth-for-youth-sandra-ablamba-johnson-invite-la-jeunesse-togolaise-a-faire-siennes-les-nobles-valeurs-de-patriotisme-de-participation-citoyenne-dexcellence-et-dhumilite" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.51.92.124


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.249.45
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-09.45.140.249.45||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.187.159.80
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-voici-les-grandes-decisions-du-conseil-des-ministres-du-30-mai-2022 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:14:09:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920553&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782050988 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.249.38
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-09.45.140.249.38||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.250.69
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-10.45.140.250.69||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:11:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:11:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.156.48
country_id: 2363686
description:
102.64.156.48 - - [21/Jun/2026:14:12:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7311765&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1871&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782051140 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1871" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.156.48


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.231.31.195
country_id: 285570
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bfa493 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.200.207
country_id: 2077456
description:
[2026-06-21 14:12:49 +0000] info [cpaneld] 146.70.200.207 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.147.100.164
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/acces-aux-financements-des-pme-pmi-lafd-appui-le-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 205.164.241.36
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-tenue-vestimentaire-du-personnel-de-sante-codifiee HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.144.202
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/4eme-edition-des-brvm-awards-le-togo-accueille-levenement-les-10-et-11-mai-prochain HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.200.207
country_id: 2077456
description:
[2026-06-21 14:13:45 +0000] info [cpaneld] 146.70.200.207 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.49.141.36
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/725803952_1346336050758625_8537351566847766639_n-300x183.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.48.59
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-300x225.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.255.49.51
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-300x300.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 63.143.116.73
country_id: 3489940
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/telechargement-1.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.157.66
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/15851 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.7.137
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7c6052 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 59.92.71.178
country_id: 1269750
description:
59.92.71.178 - - [21/Jun/2026:14:19:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919579&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782051587 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:59.92.71.178


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 117.136.33.20
country_id: 1814991
description:
2026-06-21 14:20:26 H=([223.74.218.20]) [117.136.33.20]:60501 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.214.20.169
country_id: 2077456
description:
[2026-06-21 14:20:28 +0000] info [cpaneld] 103.214.20.169 - hini89 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hini89 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.214.20.169
country_id: 2077456
description:
[2026-06-21 14:20:40 +0000] info [cpaneld] 103.214.20.169 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.120.28.230
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/140567192 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 117.2.186.61
country_id: 1562822
description:
117.2.186.61 - - [21/Jun/2026:14:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669413&pdata=https%253A%252F%252Ftogodailynews.tg%252Fbsg-2025-renforcement-des-capacites-des-acteurs-impliques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782051737 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/bsg-2025-renforcement-des-capacites-des-acteurs-impliques/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.1542.1825 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:117.2.186.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.214.20.169
country_id: 2077456
description:
[2026-06-21 14:24:51 +0000] info [cpaneld] 103.214.20.169 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.119.135.133
country_id: 1831722
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a29c93 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.246.138
country_id: 1880251
domain: sia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:92.113.246.138||TA:92.113.246.138||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:26:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:26:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 103.214.20.169
country_id: 2077456
description:
[2026-06-21 14:25:38 +0000] info [cpaneld] 103.214.20.169 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.158.109
country_id: 1733045
description:
161.142.158.109 - - [21/Jun/2026:14:27:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092717&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fnouveau-partenariat-acp-ue-les-negociateurs-en-chef-concluent-une-serie-de-consultations-regionales-fructueuses&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052021 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/nouveau-partenariat-acp-ue-les-negociateurs-en-chef-concluent-une-serie-de-consultations-regionales-fructueuses" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.158.109


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.73.215
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/flags/svg/fr.svg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.147.134.133
country_id: 1643084
description:
103.147.134.133 - - [21/Jun/2026:14:27:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050392&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052063 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.147.134.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.1.247.67
country_id: 3686110
description:
179.1.247.67 - - [21/Jun/2026:14:27:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528157&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052064 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.1.247.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.212.211
country_id: 1733045
description:
14.192.212.211 - - [21/Jun/2026:14:29:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9920869&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F47613&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052162 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/47613" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.212.211


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 79.126.120.199
country_id: 2017370
description:
2026-06-21 14:29:45 H=([79.126.120.199]) [79.126.120.199]:12708 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 131.222.251.70
country_id: 298795
description:
131.222.251.70 - - [21/Jun/2026:14:30:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314785&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052256 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:131.222.251.70


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.193.203.146
country_id: 3469034
description:
177.193.203.146 - - [21/Jun/2026:14:30:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592615&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052257 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.193.203.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-21 14:32:56 +0000] info [whostmgrd] 103.77.107.71 - koolnetfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.2.180
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/insecurite-et-grand-banditisme-un-coup-de-filet-reussi-a-adeticope/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.255.96.14
country_id: 3469034
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60123.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c3e3f7751fc20ba39f2d371b1c189d80e617305||Title:0xf4511d42||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.145.216.41
country_id: 1733045
description:
175.145.216.41 - - [21/Jun/2026:14:37:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986652&pdata=https%253A%252F%252Fwebmail.supermercandotogo.free.netmaster.tg%252F%253Flocale%253Dja&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052647 HTTP/2.0" 302 0 webmail.supermercandotogo.free.netmaster.tg "https://webmail.supermercandotogo.free.netmaster.tg/?locale=ja" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.145.216.41


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.48.68.22
country_id: 1210997
description:
182.48.68.22 - - [21/Jun/2026:14:38:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13222804&pdata=https%253A%252F%252Fwebmail.florian.free.netmaster.tg%252F%253Flocale%253Dth&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052720 HTTP/2.0" 302 0 webmail.florian.free.netmaster.tg "https://webmail.florian.free.netmaster.tg/?locale=th" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.48.68.22


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.93
country_id: 3469034
description:
Jun 21 14:40:45 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:41:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:41:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.78.165
country_id: 6252001
description:
[2026-06-21 14:41:46 +0000] info [cpaneld] 217.181.78.165 - qfaclpeg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.77.96
country_id: 6252001
description:
[2026-06-21 14:41:43 +0000] info [cpaneld] 217.181.77.96 - qfaclpeg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:14:41:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105132&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782052901 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.163.235
country_id: 1880251
description:
104.28.163.235 - - [21/Jun/2026:14:43:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843796&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Flotr-facilite-la-vie-aux-togolais%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782053023 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Flotr-facilite-la-vie-aux-togolais%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.163.235


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.104.203.4
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/liste-des-pharmacies-de-garde-de-la-periode-du-01-au-08-juillet-2024 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.103.166.56
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/volontariat-victoire-tomegah-dogbe-a-echange-avec-yann-delaunay HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.216.106.119
country_id: 1643084
description:
103.216.106.119 - - [21/Jun/2026:14:44:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118490&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782053075 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.216.106.119


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 36.64.119.114
country_id: 1643084
description:
36.64.119.114 - - [21/Jun/2026:14:45:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13331352&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782053099 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:36.64.119.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.84
country_id: 6251999
description:
[2026-06-21 14:47:24 +0000] info [cpaneld] 217.181.82.84 - yydrdvav "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.210.190.179
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-ladaptation-climatique-une-priorite-nationale HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.171.204.88
country_id: 2963597
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-9-sur-10-menages-ont-acces-a-lelectricite-en-milieu-urbain HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.95.86.65
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/erosion-cotiere-le-togo-a-loeuvre-pour-sauver-les-meubles HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.145.229.209
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sommet-de-lua-les-dirigeants-africains-appellent-les-24-derniers-etats-a-ratifier-le-traite-de-lama HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.211.192
country_id: 6252001
description:
[2026-06-21 14:48:59 +0000] info [cpaneld] 73.120.211.192 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.200.31.117
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/togo-une-protection-offerte-a-tous-les-enfants-de-5-mois-dage/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.31.97
country_id: 6252001
description:
[2026-06-21 14:49:18 +0000] info [cpaneld] 74.105.31.97 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.8.164.42
country_id: 6252001
description:
[2026-06-21 14:49:37 +0000] info [cpaneld] 73.8.164.42 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.93.169.26
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/barometre-cian-2021-le-togo-classe-troisieme-en-afrique/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.99.43.10
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-la-piraterie-maritime-le-systeme-juridique-togolais-se-renforce HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.144.253
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/5258 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.215.48
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fatou-fall-nommee-representante-residente-du-groupe-de-la-banque-mondiale-pour-djibouti HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.18.59
country_id: 2635167
description:
2026-06-21 14:52:25 dovecot_plain authenticator failed for H=(HY-40814) [149.102.18.59]:33420: 535 Incorrect authentication data (set_id=issj@ucao-uut.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.152.98.228
country_id: 289688
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-le-terrorisme-luemoa-renforce-la-chaine-penale-par-des-outils-operationnels-standardises HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.254.34.32
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/promotion-de-la-sante-pour-tous-faure-gnassingbe-a-echange-avec-la-directrice-generale-de-sante-integree/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.18.59
country_id: 2635167
description:
2026-06-21 14:52:32 dovecot_login authenticator failed for H=(HY-40814) [149.102.18.59]:33420: 535 Incorrect authentication data (set_id=issj@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.229.229.0
country_id: 1562822
description:
171.229.229.0 - - [21/Jun/2026:14:53:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725035&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782053582 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.229.229.0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.105.67
country_id: 6252001
description:
[2026-06-21 14:53:11 +0000] info [cpaneld] 82.40.105.67 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.182.85.204
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/mobile-money-81-000-points-de-service-pour-une-inclusion-financiere-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.63.205.152
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-la-desertification-faure-gnassingbe-participe-au-sommet-des-chefs-detat-de-la-cop15 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:56:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:14:56:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.107.224.32
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/covid-19-ladministration-de-la-seconde-dose-du-vaccin-astrazeneca-debute-ce-lundi-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.56.243
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/6569 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.163.195.45
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-renforce-sa-place-dans-la-strategie-rizicole-regionale HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.43.133
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/limitation-de-carte-sim-a-3-par-abonne-larcep-donne-plus-de-details HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:14:57:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262168&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782053876 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.151.136.235
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/electrification-pour-tous-au-togo-lue-subventionne-le-perecut-de-95-milliards-fcfa/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.221.109.101
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/hcte-488-inscrits-pour-conquerir-77-sieges HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.219.156.188
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/ag-millenium-microfinance-une-sante-financiere-au-point/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.79.214
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/covid-19-la-plateforme-covid-watch-fait-des-recommandations/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.0.247.106
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-couverture-medicale-universelle-laspiration-dun-togo-en-marche-vers-le-developpement-et-linclusion-sociale/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.88.55.15
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-lance-lapi-pour-une-gestion-publique-transparente HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.202.48.91
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/miato-les-artisans-togolais-en-font-leur-festin HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.244
country_id: 798544
description:
Jun 21 15:03:24 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.244
country_id: 798544
description:
Jun 21 15:03:31 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.197.14
country_id: 2921044
description:
2026-06-21 15:04:41 dovecot_plain authenticator failed for H=(4hsexf18kwms6jpqsz7g28rku4hee) [104.28.197.14]:14580: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [21/Jun/2026:15:10:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040882&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782054635 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:15:11:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998381&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782054687 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:11:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:11:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.52.218.97
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/presidence-de-la-boad-christian-adovelande-passe-la-main-a-serge-ekue HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.62
country_id: 2017370
description:
Jun 21 15:12:12 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.213.230.75
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-justice-plus-accessible-aux-populations HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.205.83.163
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cooperation-bilaterale-yawa-djigbodi-tsegan-echange-avec-sanjiv-tandon HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.62
country_id: 2017370
description:
2026-06-21 15:12:14 dovecot_login authenticator failed for H=([196.188.187.205]) [178.178.222.62]:44120: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-21 15:13:01 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:12885: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.119.40.243
country_id: 294640
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:212.119.40.243||TA:212.119.40.243||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.118.104
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/madagascarnewsroom-madagascar-assurance-agricole-ifc.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.56.9.61
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/soutien-des-femmes-entrepreneures-et-des-etudiants-laccelerateur-dagba-lance-deux-nouveaux-programmes HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.23.205.108
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1101658776 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.141
country_id: 3175395
description:
209.227.239.141 - - [21/Jun/2026:15:17:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997450&pdata=https%253A%252F%252Fsnb.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782055073 HTTP/2.0" 302 0 snb.tg "https://snb.tg/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.141


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.139.49.229
country_id: 248816
domain: www.lepoint-actu.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lepoint-actu.tghttp/www.lepoint-actu.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.139.49.229
country_id: 248816
domain: www.lepoint-actu.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lepoint-actu.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 165.101.82.12
country_id: 1643084
description:
165.101.82.12 - - [21/Jun/2026:15:22:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236970&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782055372 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:165.101.82.12


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 74.114.150.94
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.78.74.8
country_id: 783754
description:
2026-06-21 15:25:41 dovecot_login authenticator failed for H=(PKGmlJk) [80.78.74.8]:34751: 535 Incorrect authentication data (set_id=kkuassi@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.78.74.8
country_id: 783754
description:
Jun 21 15:25:39 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.78.74.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:15:27:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379052&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782055639 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:26:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:26:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.164.188
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:199.96.164.188||TA:199.96.164.188||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.3.179
country_id: 2363686
description:
[2026-06-21 15:31:35 +0000] info [webmaild] 196.169.3.179 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 163.227.145.131
country_id: 1210997
description:
163.227.145.131 - - [21/Jun/2026:15:33:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054555&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fforum-togo-ue-fin-de-la-premiere-edition-rendez-vous-en-2020&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782055979 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/forum-togo-ue-fin-de-la-premiere-edition-rendez-vous-en-2020" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:163.227.145.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.4.124
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/02/jeunes-entrepreneurs-africains-780x470-1.jpg 780w, http:/togodailynews.tg/wp-content/uploads/2025/02/jeunes-entrepreneurs-africains-780x470-1-300x181.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2025/02/jeunes-entrepreneurs-africains-780x470-1-768x463.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.205.180.228
country_id: 1605651
description:
223.205.180.228 - - [21/Jun/2026:15:39:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869972&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782056359 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.205.180.228


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.13.222.56
country_id: 1733045
description:
124.13.222.56 - - [21/Jun/2026:15:38:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804187&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782056334 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/agriculture/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.13.222.56


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.63.157.15
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/photo-protection-sociale-1-780x470-1.webp 780w, http:/togodailynews.tg/wp-content/uploads/2026/01/photo-protection-sociale-1-780x470-1-300x181.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/01/photo-protection-sociale-1-780x470-1-768x463.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.199.200.233
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31e7b430b31d7303e31fcadebfff0a9040624bf1||Title:i8xu1aof4xkpcq451a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:42:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:42:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.203.235.249
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-le-covid-19-le-gouvernement-allege-les-mesures-restrictives HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.36.195.181
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/the-origin-of-pan-africanism-and-its-role-today-in-relation-to-africa-development HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.152.228.133
country_id: 1168579
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d9646fd0203ab465f672b524f398a09ff81d644||Title:apczzky2ptfuv6||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.199.200.233
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:82972aeaa93c09fbabee395ac597f6c2f392d412||Title:17xs6n34ua4un8r||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:15:43:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7303023&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782056611 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.232.225.111
country_id: 2017370
description:
37.232.225.111 - - [21/Jun/2026:15:43:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816470&pdata=https%253A%252F%252Fwebmail.africa.netmaster.tg%252F%253Flocale%253Dms&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782056629 HTTP/2.0" 302 0 webmail.africa.netmaster.tg "https://webmail.africa.netmaster.tg/?locale=ms" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.232.225.111


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.213.230.125
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/taux-dacces-au-cp1-une-progression-spectaculaire-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.31.184
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/63214043 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.228.110.236
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/243121521 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.50.104.99
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/41\xe1\xb5\x89-edition-de-tislim-difoini-nadoba-fait-vibrer-le-patrimoine-culturel-du-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.174.164
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/jobs-and-contributors/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.199.200.233
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea83b5e1b4139affd7b48b675bcbb6e2d9f0dc32||Title:cdq8btkjpxgf8dm||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.147.192
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1291703028 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.194.144.86
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1185987592 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.93.3.100
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/elections-en-cote-divoire-johaness-makouvia-nomme-chef-de-la-mission-dobservation-electorale HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.104.17.87
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7f816f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.49.202.131
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7eme-edition-de-la-fete-bakatue-anezan-sandra-ablamba-johnson-represente-le-chef-de-letat HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.205.187
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-des-coupures-electriques-annoncees-jusquau-08-fevrier-2026 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.222.226.72
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/artisanat-au-togo-vers-le-professionnalisme-et-la-creation-demplois HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:57:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:15:57:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.163.8
country_id: 2363686
description:
[2026-06-21 15:57:22 +0000] info [webmaild] 102.64.163.8 - kagbekoh@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:15:58:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988755&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782057484 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.192
country_id: 6252001
description:
Jun 21 15:58:00 ns5 pure-ftpd[1675808]: (?@198.235.24.192) [INFO] New connection from 198.235.24.192


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.58.134.214
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/aeroport-de-lome-6-de-hausse-du-trafic-passager-une-dynamique-confirmee HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.190.223.187
country_id: 337996
description:
196.190.223.187 - - [21/Jun/2026:15:59:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921155&pdata=https%253A%252F%252Fcpanel.tera-afrique.free.netmaster.tg%252F%253Flocale%253Dnl&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782057597 HTTP/2.0" 302 0 cpanel.tera-afrique.free.netmaster.tg "https://cpanel.tera-afrique.free.netmaster.tg/?locale=nl" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.190.223.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.230.86.8
country_id: 1512440
description:
213.230.86.8 - - [21/Jun/2026:16:00:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738185&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-19159letidm65x.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782057612 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-19159letidm65x.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.230.86.8


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 84.21.190.140
country_id: 2635167
domain: group-gci.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.19||T:APACHE||REQUEST_URI:/wp-content/plugins/giftware/changelog.txt||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.210.127.134
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-vers-laccessibilite-des-services-de-soins-pour-tous HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.63.186.26
country_id: 3351879
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/une-campagne-de-georeferencement-des-titres-fonciers-pre-2007-lancee HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.158.214.253
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/grande-finale-du-concours-latelier-de-lavenir-70-laureats-2-000-spectateurs-et-une-nouvelle-vague-de-projets-pour-le-congo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.213.151
country_id: 614540
description:
Jun 21 16:01:09 ns5 auth[1450573]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.213.151 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.213.120.7
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/des-reflexions-pour-actualiser-le-prdtour-pour-une-seconde-phase HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.190.90.162
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/climat-des-affaires-le-togo-a-le-vent-en-poupe HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.135.50.158
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/agou-pari-gagne-pour-la-journee-nationale-du-sport HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.207.8.91
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/free-roaming-le-togo-realise-une-nouvelle-avancee-majeure/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.198.24.52
country_id: 2963597
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/elections-legislatives-et-regionales-2024-a-bassar-unir-entre-en-campagne-par-des-rencontres-dechanges HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.27.47
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-chute-du-taux-de-mortalite-hospitaliere/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 111.228.42.12
country_id: 1814991
domain: djama.tg
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.32.219
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/qualite-des-soins-de-sante-au-togo-loms-appui-le-togo-avec-105-millions-fcfa/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.108.20.218
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/programme-presidentiel-dexcellence-lancement-de-la-deuxieme-promotion HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.119.231.207
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/8201 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.163.8
country_id: 2363686
description:
[2026-06-21 16:05:21 +0000] info [webmaild] 102.64.163.8 - kagbekoh@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.234.249.89
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/connection-des-entrepreneurs-aux-investisseurs-le-programme-cajet-pose-ses-valises-au-grand-lome HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/21/2026:16:05:46 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 209.58.152.29
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r33309||MV:16-05.209.58.152.29||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.3.143.168
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-06.192.3.143.168||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.175.110.4
country_id: 3277605
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/surete-aeronautique-le-togo-simpose-desormais-dans-la-categorie-des-etats-ayant-atteint-un-taux-de-conformite-superieur-a-90 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.159.225.239
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-vers-un-controle-effectif-sur-les-activites-relatives-aux-armes/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.247.90.198
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/les-micro-infrastructures-se-decuplent-pour-le-bien-etre-des-menages-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.135.178
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cooperation-ouverture-dune-nouvelle-page-des-relations-entre-linde-et-le-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.130.238
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-74-2-1024x683-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-74-2-1024x683-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-74-2-1024x683-1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-74-2-1024x683-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [21/Jun/2026:16:11:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987526&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782058261 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [21/Jun/2026:16:11:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119834&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782058262 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [21/Jun/2026:16:11:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6910056&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782058304 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.43.183
country_id: 2077456
description:
2026-06-21 16:11:47 dovecot_login authenticator failed for H=([102.33.36.254]) [101.168.43.183]:56580: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.67.158.221
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/4201 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:16:11:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:16:11:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [21/Jun/2026:16:11:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7433620&pdata=http%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782058303 HTTP/1.1" 302 0 snb.tg "http://snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.212.10
country_id: 1562822
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/presentation HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.210.69.236
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/programme-presidentiel-dexcellence-une-vache-a-lait-des-jeunes-diplomes/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:16:13:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051205&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782058431 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.11.212.220
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/fin-de-la-premiere-session-ordinaire-de-lannee-2023-bilan-legislatif-et-cloture-solennelle/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.71.181.218
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c8cac6 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2026-06-21 16:16:34 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp ([24.249.199.26]) [113.158.205.225]:45124: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.72
country_id: 290557
description:
2026-06-21 16:16:49 H=([217.60.195.72]) [217.60.195.72]:55355 F=<sales@artistrelatedgroup.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.70.252.249
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/1_7.webp 360w, http:/togodailynews.tg/wp-content/uploads/2026/04/1_7-300x186.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.223.238.198
country_id: 2750405
description:
159.223.238.198 - - [21/Jun/2026:16:19:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817603&pdata=https%253A%252F%252Fmacite.tg%252Fafrica-newsroom%252F%253Fq%253Dtiktok-unveils-expansion-of-global-mental-health-fund-and-innovative-safety-tools-to-champion-digital-wellbeing-in-africa%253Fq%253Dtony-elumelu-foundation-selects-seven-north-african-entrepreneurs-in-2026-cohort%2526pr%253D369771%2526lang%253Dar&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782058741 HTTP/2.0" 302 0 macite.tg "https://macite.tg/africa-newsroom/?q=tiktok-unveils-expansion-of-global-mental-health-fund-and-innovative-safety-tools-to-champion-digital-wellbeing-in-africa?q=tony-elumelu-foundation-selects-seven-north-african-entrepreneurs-in-2026-cohort&pr=369771&lang=ar" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.223.238.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.71.204.217
country_id: 3658394
description:
186.71.204.217 - - [21/Jun/2026:16:21:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067673&pdata=https%253A%252F%252Fcpanel.ekoue.free.netmaster.tg%252F%253Flocale%253Den&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782058874 HTTP/2.0" 302 0 cpanel.ekoue.free.netmaster.tg "https://cpanel.ekoue.free.netmaster.tg/?locale=en" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.71.204.217


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.232.121.6
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1904487267 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:16:26:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:16:26:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-21 16:25:51 +0000] info [cpaneld] 103.65.237.57 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:16:27:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723697&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782059230 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dc425fbb2f533e1f04324e70b9e57144e8642d60||Title:2dao382kndv2whx||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [21/Jun/2026:16:30:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711703&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F04%252F06%252Fd1-debut-du-championnat-les-resultats-de-la-1ere-journee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782059440 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2021/04/06/d1-debut-du-championnat-les-resultats-de-la-1ere-journee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c23bd73c77de62f6118d41cd1d937e17f65e7c18||Title:u41z58norxleran||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.175.234.79
country_id: 2921044
description:
185.175.234.79 - - [21/Jun/2026:16:30:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462612&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fatakora-lalawele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782059429 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/atakora-lalawele/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2673.1205 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.175.234.79


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:acf77ec035d8e4812439139428b7294ffa8f9576||Title:ygk78oltdtiu797ij5||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aafd5a0115013efb071bc18dbf1ec85383349fa9||Title:0hamk9z9gmiu16bd7||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d44ebd99208fe3a8641bbc61ca7ba58a0d2fa3af||Title:w7tdgp7m46as9x6nyu||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.157.233.28
country_id: 6252001
description:
[2026-06-21 16:33:35 +0000] info [cpaneld] 54.157.233.28 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:72229c0338570fb2ace0c7f8f9c5ebfcc295bd3b||Title:t7nyta5uyjl4gtatnf||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.173.12
country_id: 1814991
description:
2026-06-21 16:36:12 dovecot_login authenticator failed for H=(dslzjj) [111.179.173.12]:60964: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:16e9be2df5a31ba8c37bb1e4e1f8301c016ed739||Title:oxd0zpyvppj86gqu7||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8496dfe3e6fe6c873827b63b1e0bc0c08c39dd41||Title:htagvlrotb5cxz||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e90bbccb3e9113f8ee306f6a97b7fca6a8427183||Title:h5iqablwx6ju99v2bm||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 145.14.137.97
country_id: 2921044
description:
145.14.137.97 - - [21/Jun/2026:16:37:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116999&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252Fcategory%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782059854 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/category/non-classe/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.3307.1210 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:145.14.137.97


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c90b57832666bf8ad7e3cc82e098c218a4f7f55||Title:kx6bo13vgshlztq||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.88.91
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a3645855a30c3aa34208ecdf5465e3132192349a||Title:9dca36y8nwmh4lk7||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.79.238
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/03/5e0b0f600791a4d84bb93e33ba22fb11_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2022/03/5e0b0f600791a4d84bb93e33ba22fb11_L-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/03/5e0b0f600791a4d84bb93e33ba22fb11_L-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.129.128
country_id: 294640
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.145.129.128||TA:45.145.129.128||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:16:40:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [21/Jun/2026:16:40:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 118.100.234.133
country_id: 1733045
description:
118.100.234.133 - - [21/Jun/2026:16:41:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788245&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fafis-lavenir-de-lafrique-se-construira-sur-la-collaboration-etroite-entre-les-gouvernements-et-le-secteur-bancaire-dixit-faure-essozimna-gnassingbe%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782060100 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Fafis-lavenir-de-lafrique-se-construira-sur-la-collaboration-etroite-entre-les-gouvernements-et-le-secteur-bancaire-dixit-faure-essozimna-gnassingbe%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:118.100.234.133


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:16:42:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516331&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782060129 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.121.100
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f7a728b29f7b5e2a0d30778c972a038ca2f8f6d||Title:p5rarfrgwfkld623e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.28.49.228
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-adhere-a-la-siace HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.121.51.140
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-taux-dinflation-sest-etabli-a-11-en-aout-2025/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-21 16:44:16 +0000] info [cpaneld] 129.212.225.47 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.121.100
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:792da7faa3f17b4b910e783efea2c31d0062b092||Title:9okvi699vyy4v8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.37.27
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/infrastructures-routieres-trois-postes-de-peage-automatise-ouverts HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.196.68.102
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/historique-de-lalimentation-scolaire-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.237.130.10
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/18981 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.89.155
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0b2835bd5a328320e88522298705fea540f1764||Title:6tslrgp8x14qegx4r||RSV:8.19||T:APACHE||


