# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.60
country_id: 798544
description:
Jun 19 21:24:38 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 21:26:08 +0000] info [cpaneld] 102.54.238.57 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.76.208
country_id: 3469034
description:
Jun 19 21:27:05 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.76.208 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:21:27:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592874&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781904476 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.139
country_id: 3175395
description:
Jun 19 21:28:22 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.139
country_id: 3175395
description:
Jun 19 21:28:29 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jun 19 21:28:42 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.170
country_id: 3469034
description:
Jun 19 21:29:27 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.170 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.165.25.42
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/992100571 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.196.16.70
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/1557927673 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.156.115.30
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/595455 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.124.11.155
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/true HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.175.119
country_id: 2363686
description:
[2026-06-19 21:33:45 +0000] info [cpaneld] 102.64.175.119 NEW zephyradmin:PHQ_gMXh1YGn6Du1 address=102.64.175.119,app=cpaneld,creator=zephyradmin,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.129.194
country_id: 1814991
description:
2026-06-19 21:33:34 dovecot_login authenticator failed for H=([70.166.167.42]) [36.132.129.194]:8828: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.109.228
country_id: 99237
description:
[2026-06-19 21:35:23 +0000] info [cpaneld] 185.181.109.228 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.104.105.135
country_id: 7626836
description:
[2026-06-19 21:35:16 +0000] info [cpaneld] 190.104.105.135 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.0.234.240
country_id: 3469034
description:
[2026-06-19 21:35:21 +0000] info [cpaneld] 187.0.234.240 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.119.84.166
country_id: 1562822
description:
[2026-06-19 21:35:35 +0000] info [cpaneld] 42.119.84.166 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.220.196.230
country_id: 3469034
description:
[2026-06-19 21:35:38 +0000] info [cpaneld] 186.220.196.230 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.176.109.40
country_id: 3932488
description:
[2026-06-19 21:35:47 +0000] info [cpaneld] 181.176.109.40 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.152.88.91
country_id: 3469034
description:
[2026-06-19 21:35:43 +0000] info [cpaneld] 200.152.88.91 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-19 21:36:47 +0000] info [webmaild] 102.64.171.58 - e.senahounvo@davakconsulting.com "GET /cpsess6572920161/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.1
country_id: 798544
description:
Jun 19 21:37:02 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.131.242
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/552048446 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.163.131.111
country_id: 3277605
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/07/LOCALE-1.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2019/07/LOCALE-1-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2019/07/LOCALE-1-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2019/07/LOCALE-1-1024x768.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.209.239
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/972862072 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.58.143.46
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/a99b98 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:21:42:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13147242&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781905333 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 37.19.206.52
country_id: 6252001
domain: soena.tg
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 47.39.67.115
country_id: 6252001
domain: ciieeinternational.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85805.ciieeinternational.org||ServerName:ciieeinternational.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:479e8f941af42afc207a89c4d9eefd7897dc8ace||Title:f82e4k0le3b48i01wv||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.154.242
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/566d68 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.221
country_id: 2300660
description:
Jun 19 21:43:22 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.221
country_id: 2300660
description:
Jun 19 21:43:29 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.154.63
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/1094744546 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.40.102
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/Togo-Les-recettes-fiscales-en-hausse-au-T3-2025-scaled-e1766740612397.webp 1000w, http:/togodailynews.tg/wp-content/uploads/2026/02/Togo-Les-recettes-fiscales-en-hausse-au-T3-2025-scaled-e1766740612397-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/Togo-Les-recettes-fiscales-en-hausse-au-T3-2025-scaled-e1766740612397-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.42.252.59
country_id: 2635167
description:
[2026-06-19 21:45:11 +0000] info [cpaneld] 217.42.252.59 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.103.161
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:152.232.103.161||TA:152.232.103.161||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.45
country_id: 690791
description:
Jun 19 21:46:20 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.45
country_id: 690791
description:
Jun 19 21:46:33 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 19 21:46:44 ns5 auth[4148957]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.86.122.109
country_id: 3625428
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/mission HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.139.173.175
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/high HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.114.192
country_id: 3057568
description:
Jun 19 21:51:10 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.114.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.234.13.40
country_id: 2017370
description:
2026-06-19 21:51:22 dovecot_plain authenticator failed for H=(pophir) [109.234.13.40]:46720: 535 Incorrect authentication data (set_id=admin@soroubat.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.15.74.17
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/469996200 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.189.237.124
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/lazy HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.26
country_id: 1562822
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-54.117.5.142.26||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.227.232
country_id: 3469034
description:
Jun 19 21:56:11 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.227.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 21:56:56 +0000] info [cpaneld] 185.55.240.13 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:21:56:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276874&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781906207 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.80.208
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0165-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0165-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0165-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0165-272x182.jpg 272w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210810-WA0165.jpg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.223.202.114
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/warsteiner HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.197.60
country_id: 2510769
description:
Jun 19 21:59:53 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.197.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.152.52.2
country_id: 3595528
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/1710657278 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.42
country_id: 2510769
description:
Jun 19 22:01:57 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jun 19 22:02:24 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.119
country_id: 3469034
description:
Jun 19 22:01:33 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jun 19 22:02:32 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.58.156.153
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/8e887b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.241.37.146
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/10/SOINS.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2020/10/SOINS-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.204.166
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/31903197 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.132.95.157
country_id: 3932488
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-la-covid-19-tout-sur-le-covax/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.1.85.243
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fesma-2023-le-comite-dorganisation-dresse-le-bilan/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.61
country_id: 3469034
description:
Jun 19 22:06:23 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.49.198
country_id: 226074
description:
Jun 19 22:07:19 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.49.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.107
country_id: 690791
description:
Jun 19 22:07:24 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.61
country_id: 3469034
description:
Jun 19 22:06:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.95.46
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/105941429 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.107
country_id: 690791
description:
Jun 19 22:07:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.49.198
country_id: 226074
description:
Jun 19 22:07:33 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.49.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.9.13
country_id: 3865483
description:
Jun 19 22:08:36 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.9.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.148
country_id: 3077311
description:
Jun 19 22:09:51 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.148 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:22:10:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329500&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781907038 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.19.181.244
country_id: 1694008
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-11.113.19.181.244||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.221.203
country_id: 3469034
description:
Jun 19 22:15:06 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.221.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.194.230.10
country_id: 3996063
description:
Jun 19 22:15:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.194.230.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.178.151
country_id: 6252001
domain: www.lasnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg/uploads/images/32.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.61
country_id: 3175395
description:
Jun 19 22:16:41 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 196.207.215.19
country_id: 2245662
domain: ucao-uut.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari/604.1 musical_ly_45.5.0 BytedanceWebview/d8a21c6||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.156.220.200
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/MAP.webp 1080w, http:/togodailynews.tg/wp-content/uploads/2026/02/MAP-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/MAP-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/02/MAP-768x432.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 22:18:42 +0000] info [cpaneld] 185.55.240.13 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.27
country_id: 3469034
description:
Jun 19 22:19:56 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.156.177.20
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/les-grandes-decisions-du-premier-conseil-des-ministres-de-lannee-2024 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.192.59
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/banque-mondiale-ahmadou-moustapha-ndiaye-nouveau-directeur-pays-pour-le-maghreb-et-malte/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.105.205
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/les-grandes-decisions-du-conseil-des-ministres-du-vendredi-12-janvier-2024 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.32.220.158
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2003739821 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.80.55
country_id: 6251999
description:
[2026-06-19 22:22:55 +0000] info [whostmgrd] 217.181.80.55 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 19 22:23:43 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.51.143.207
country_id: 3658394
description:
179.51.143.207 - - [19/Jun/2026:22:23:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906265&pdata=https%253A%252F%252F24heureinfo.tg%252Fdeveloppement%252F300-localites-auront-acces-a-lelectricite-au-togo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781907828 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/developpement/300-localites-auront-acces-a-lelectricite-au-togo" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.51.143.207


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.138.132.250
country_id: 1733045
description:
175.138.132.250 - - [19/Jun/2026:22:24:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10187375&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F23035&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781907865 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/23035" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.138.132.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.125
country_id: 798544
description:
Jun 19 22:25:22 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.88
country_id: 298795
description:
Jun 19 22:24:40 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.88 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.183.160
country_id: 6252001
domain: www.lepoint-actu.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:209.127.183.160||TA:209.127.183.160||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.125
country_id: 798544
description:
Jun 19 22:25:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.125 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:22:26:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776775&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781908012 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 19 22:29:39 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.21.118
country_id: 798544
description:
Jun 19 22:32:22 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.21.118 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.100.58
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:198.105.100.58||TA:198.105.100.58||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.21.118
country_id: 798544
description:
Jun 19 22:32:29 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.21.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.204.114.106
country_id: 3489940
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.02-1-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.02-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.02-1-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.02-1-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.02-1.jpeg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 19 22:34:45 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.90.235
country_id: 1668284
description:
Jun 19 22:36:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.90.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.67.246
country_id: 6252001
description:
[2026-06-19 22:36:37 +0000] info [cpaneld] 82.40.67.246 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 188.3.76.113
country_id: 298795
description:
[2026-06-19 22:37:46 +0000] info [cpaneld] 188.3.76.113 NEW wcnyaruu:qSAfOZT6XIjeQKfi address=188.3.76.113,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:22:40:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711192&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781908855 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.254.198
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:191.96.254.198||TA:191.96.254.198||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.233.185.13
country_id: 798544
description:
Jun 19 22:44:21 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.233.185.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.211.21.213
country_id: 1269750
description:
Jun 19 22:43:33 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.211.21.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.233.185.13
country_id: 798544
description:
Jun 19 22:44:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.233.185.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 146.103.55.234
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:146.103.55.234||TA:146.103.55.234||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.61.242.164
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2070504834 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.85.218
country_id: 6252001
description:
[2026-06-19 22:48:41 +0000] info [cpaneld] 82.40.85.218 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 22:49:54 +0000] info [cpaneld] 185.55.240.13 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.96
country_id: 3996063
description:
Jun 19 22:51:59 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.103.210.62
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/973455736 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.40.73
country_id: 3469034
description:
Jun 19 22:53:26 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.40.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.40.73
country_id: 3469034
description:
Jun 19 22:53:34 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.40.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
country_id: 1814991
description:
Jun 19 22:54:14 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
country_id: 1814991
description:
2026-06-19 22:54:16 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [36.137.38.119]:60172: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.91.113.30
country_id: 3469034
description:
Jun 19 22:55:01 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.91.113.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:22:55:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116947&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781909726 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 93.112.128.8
country_id: 102358
description:
[2026-06-19 22:57:28 +0000] info [cpaneld] 93.112.128.8 NEW ifxmoxbf:MQXaoEhKIOrkdNxE address=93.112.128.8,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.243.203.204
country_id: 6252001
description:
2026-06-19 22:58:48 dovecot_plain authenticator failed for H=(2o2079qmtvwi0vfp9s7uzmmctvjzso9x) [162.243.203.204]:40926: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.223.105.27
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.04-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.04-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.04-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.04-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2021/10/WhatsApp-Image-2021-10-12-at-09.45.04.jpeg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.113.129.120
country_id: 2017370
description:
2026-06-19 23:03:10 dovecot_plain authenticator failed for H=(cactre) [37.113.129.120]:56238: 535 Incorrect authentication data (set_id=admin@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.8.182.12
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/998985 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.84.175.3
country_id: 1643084
description:
115.84.175.3 - - [19/Jun/2026:23:07:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052762&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-109219hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781910452 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-109219hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.84.175.3


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.242.49.42
country_id: 1562822
description:
171.242.49.42 - - [19/Jun/2026:23:09:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722709&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fsfi-investit-56-milliards-de-dollars-en-soutien-au-developpement-du-secteur-prive&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781910592 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/sfi-investit-56-milliards-de-dollars-en-soutien-au-developpement-du-secteur-prive" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.242.49.42


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.254.34.205
country_id: 2635167
domain: caissederetraites.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:155.254.34.205||TA:155.254.34.205||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:23:11:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9541535&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781910694 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.192.52.116
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-agri-pme-une-aide-precieuse-offerte-aux-agriculteurs-togolais HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.92.189
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-alloue-118-milliards-fcfa-a-son-premier-budget-vert HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.2.146.231
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-raffermit-sa-resilience-climatique-avec-de-nouveaux-projets HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.225.30
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/plan-national-dinvestissement-forestier-le-togo-veut-restaurer-14-millions-dhectares-deboises/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.12.58
country_id: 3469034
description:
Jun 19 23:13:43 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.12.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.14
country_id: 3175395
description:
Jun 19 23:14:40 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.132.124.253
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:91.132.124.253||TA:91.132.124.253||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.206.69.179
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:206.206.69.179||TA:206.206.69.179||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.128.248.173
country_id: 6252001
description:
Jun 19 23:17:46 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.128.248.173 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.134.30
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/developpement-economique-inclusif-kossi-lamadokou-en-seance-de-travail-avec-les-acteurs-culturels-a-kara/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.10.21
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=17333 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.242.202
country_id: 2510769
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:92.113.242.202||TA:92.113.242.202||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.115.248
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/acces-a-lenergie-electrique-le-togo-prend-son-envol HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.153.106.246
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/menaces-et-intimidations-contre-roger-amemavoh-le-gouvernement-reagit HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.19.78.225
country_id: 1643084
description:
103.19.78.225 - - [19/Jun/2026:23:22:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10260934&pdata=https%253A%252F%252F24heureinfo.tg%252Ffinances%252Ftogo-les-deputes-balisent-la-voie-a-laffacturage&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781911341 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/finances/togo-les-deputes-balisent-la-voie-a-laffacturage" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.19.78.225


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-22.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.95.189
country_id: 3865483
description:
Jun 19 23:23:21 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.95.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.95.189
country_id: 3865483
description:
Jun 19 23:23:29 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.95.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.82.21.169
country_id: 1562822
description:
2026-06-19 23:23:32 dovecot_plain authenticator failed for H=(pe9rwdiwg2u6whag6jnwejf2m3jp1et) [103.82.21.169]:39390: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 14.51.86.78
country_id: 1835841
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a526b17ef8d51b4d3ab22a30297b9b1539880dd0||Title:kgejd4fr67djfyz1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.106.154
country_id: 1880251
description:
[2026-06-19 23:24:47 +0000] info [cpaneld] 165.22.106.154 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 14.51.86.78
country_id: 1835841
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a4dd1687c0e8697adbef1fcf859eb6fd5cb8f2b||Title:zocc7ry3xdnrdf4||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.11.243.81
country_id: 6252001
description:
2026-06-19 23:25:35 H=([141.11.243.81]) [141.11.243.81]:15594 F=<sarah@futurhealth.living> rejected RCPT <prakash@white-ways.com>: The mail server could not deliver mail to prakash@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:23:27:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015195&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781911630 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.115
country_id: 3175395
description:
Jun 19 23:26:46 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 158.247.200.150
country_id: 1835841
domain: myworkafrica.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?exclude=999999&per_page=100&_fields=id,slug||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.112.224.4
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a3a3a1 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.126.50
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/t\xc3\xa9l\xc3\xa9chargement.jpeg 318w, http:/togodailynews.tg/wp-content/uploads/2021/07/t\xc3\xa9l\xc3\xa9chargement-300x150.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.185.143.172
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a837b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 19 23:31:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-19 23:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:54456: 535 Incorrect authentication data (set_id=nexus001)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.254.137
country_id: 3017382
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:148.135.254.137||TA:148.135.254.137||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.117
country_id: 3175395
description:
Jun 19 23:32:35 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.186.179
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210713-WA0207.jpg 1040w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210713-WA0207-300x135.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210713-WA0207-768x346.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210713-WA0207-1024x461.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.226.235
country_id: 3469034
description:
Jun 19 23:33:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.226.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.237.125.216
country_id: 99237
description:
Jun 19 23:34:36 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.237.125.216 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.189.101.140
country_id: 3895114
description:
186.189.101.140 - - [19/Jun/2026:23:34:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919580&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F05%252F18%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781912087 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/05/18/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.4724.1642 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.189.101.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.125.216
country_id: 99237
description:
2026-06-19 23:34:38 dovecot_plain authenticator failed for H=(zg6l5hjh7tfd0nmmphnbk1rwzz5ei0) [212.237.125.216]:60212: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.101
country_id: 1733045
description:
113.211.214.101 - - [19/Jun/2026:23:35:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739205&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fuemoa-togo-station-de-pesage-de-tsevie-sera-operationnelle-en-mars-2021&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781912133 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/uemoa-togo-station-de-pesage-de-tsevie-sera-operationnelle-en-mars-2021" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.101


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.198.7
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-1024x686.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-300x201.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-768x514.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04.jpeg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.209.9.61
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-1-1024x684.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-1-768x513.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-1-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-1.jpeg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.198.147
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2024\xc2\xa0: Faure Gnassingb\xc3\xa9 assiste \xc3\xa0 la grande finale de Pya||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.237.203.255
country_id: 1880251
description:
2026-06-19 23:39:51 dovecot_plain authenticator failed for H=(rqtj4aera1uwns2vai8rnvvkaokwbz) [47.237.203.255]:52180: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.76.254
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.223
country_id: 953987
description:
Jun 19 23:40:59 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.223 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:23:42:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068742&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781912532 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.9
country_id: 3469034
description:
Jun 19 23:41:38 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.9 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [19/Jun/2026:23:42:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054554&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781912573 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.8.143
country_id: 1668284
description:
Jun 19 23:43:52 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.8.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.43.129.10
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1755429084 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 19 23:48:10 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-19 23:48:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:50902: 535 Incorrect authentication data (set_id=fedorabackup)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.11
country_id: 3469034
description:
Jun 19 23:48:19 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.11 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.109
country_id: 1733045
description:
113.211.214.109 - - [19/Jun/2026:23:47:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13132947&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-selection-centre-formation-mecanique-agricole%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781912848 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-selection-centre-formation-mecanique-agricole/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2881.1624 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.11
country_id: 3469034
description:
Jun 19 23:48:34 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.66.238
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/743543668 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.29.235.128
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:154.29.235.128||TA:154.29.235.128||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.29.19
country_id: 933860
description:
Jun 19 23:52:39 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.29.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.100.253
country_id: 1269750
description:
Jun 19 23:52:46 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.100.253 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 121.121.214.126
country_id: 1733045
description:
121.121.214.126 - - [19/Jun/2026:23:53:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7510385&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-nouveau-peage-segbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781913235 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-nouveau-peage-segbe/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.6607.1976 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:121.121.214.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 23:53:56 +0000] info [cpaneld] 185.55.240.13 - Benito "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Benito (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.66.148.99
country_id: 2921044
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2.jpg 1300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-300x123.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-768x316.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-1024x421.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.85.126
country_id: 6252001
description:
[2026-06-19 23:53:47 +0000] info [cpaneld] 82.40.85.126 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.50.232.67
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/92053c0004d893ef36690d2a9ee3676b_L.webp 500w, http:/togodailynews.tg/wp-content/uploads/2026/04/92053c0004d893ef36690d2a9ee3676b_L-300x203.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.114.166
country_id: 6252001
description:
[2026-06-19 23:54:31 +0000] info [cpaneld] 82.40.114.166 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.100.64
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210709_094004_951-800x445.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210709_094004_951-800x445-300x167.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210709_094004_951-800x445-768x427.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.100.11
country_id: 3175395
description:
Jun 19 23:57:12 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.100.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 23:58:24 +0000] info [cpaneld] 185.55.240.13 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [19/Jun/2026:23:58:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210728&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781913491 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.225.162.186
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190822-WA0031.jpg 315w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190822-WA0031-300x181.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.90
country_id: 3469034
description:
Jun 19 23:58:18 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.127
country_id: 798544
description:
Jun 19 23:57:29 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.51.45
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.51.45
country_id: 2260494
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.90
country_id: 3469034
description:
Jun 19 23:58:32 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.90 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:23:58:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999462&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781913511 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.12.58
country_id: 3469034
description:
Jun 20 00:00:06 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.12.58 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.193.176
country_id: 6251999
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.252.193.176||TA:104.252.193.176||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.46.118
country_id: 2635167
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:145.223.46.118||TA:145.223.46.118||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.242.101.184
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/3cbcbe HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.67.247.182
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/solidarite-nationale-le-fil-conducteur-de-la-politique-de-developpement-togolaise HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-20 00:03:21 +0000] info [cpaneld] 103.65.237.227 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.98.45.238
country_id: 6252001
description:
Jun 20 00:02:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.98.45.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-06-20 00:02:32 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (suitic) [24.98.45.238]:60108: 535 Incorrect authentication data (set_id=admin@sigm.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.209.252
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/projet-cizo-lelectrification-rurale-au-togo-atteint-des-sommets-avec-la-distribution-de-134-431-kits-solaires/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.103.160
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lacademie-afreximbank-accueillera-un-programme-de-formation-pour-aider-les-entreprises-africaines-a-beneficier-de-la-zleca HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-20 00:04:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:51867: 535 Incorrect authentication data (set_id=jiratraining)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.107
country_id: 3175395
description:
Jun 20 00:07:57 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.145.205
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/531836132 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.72
country_id: 290557
description:
2026-06-20 00:09:03 H=([217.60.195.72]) [217.60.195.72]:65413 F=<sales@artistrelatedgroup.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.142
country_id: 2300660
description:
Jun 20 00:08:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.40
country_id: 3469034
description:
Jun 20 00:09:26 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.40
country_id: 3469034
description:
Jun 20 00:09:34 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.101.120
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.28.112.155
country_id: 1643084
description:
103.28.112.155 - - [20/Jun/2026:00:12:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262126&pdata=https%253A%252F%252F24heureinfo.tg%252F%253Fp%253D64120&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914323 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/?p=64120" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.28.112.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 58.187.179.135
country_id: 1562822
description:
58.187.179.135 - - [20/Jun/2026:00:11:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326894&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F11502&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914301 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/11502" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:58.187.179.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:00:12:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932118&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914353 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.10.148
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.238.10.148||TA:104.238.10.148||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.3
country_id: 3469034
description:
Jun 20 00:13:26 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.3 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:12:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592107&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914352 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 204.154.201.98
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/928f90 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:00:13:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906771&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914412 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.66.154
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a-addis-abeba-le-togo-impulse-une-decision-historique-sur-la-cartographie-de-lafrique/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.111.225.171
country_id: 1210997
description:
103.111.225.171 - - [20/Jun/2026:00:14:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787985&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F04%252F16%252Fecraser-un-cafard-pas-une-bonne-idee-cest-meme-tres-dangereux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914466 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/04/16/ecraser-un-cafard-pas-une-bonne-idee-cest-meme-tres-dangereux/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.3747.1227 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.111.225.171


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.3
country_id: 3469034
description:
Jun 20 00:13:34 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.3 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:13:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:13:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:13:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004648&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914424 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 153.67.181.202
country_id: 3865483
description:
153.67.181.202 - - [20/Jun/2026:00:19:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985621&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-111283retid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914758 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-111283retid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:153.67.181.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.191.52.239
country_id: 1562822
description:
14.191.52.239 - - [20/Jun/2026:00:19:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078054&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fdrame-de-ngodo-le-gouvernement-au-cote-des-familles-des-victimes%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914763 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Fdrame-de-ngodo-le-gouvernement-au-cote-des-familles-des-victimes%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.191.52.239


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-20 00:21:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:62550: 535 Incorrect authentication data (set_id=corpmailer-daemon)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.250.162.113
country_id: 1562822
description:
171.250.162.113 - - [20/Jun/2026:00:21:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10210205&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Ftogo-le-president-burkinabe-roch-kabore-annule-son-voyage-sur-lome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781914867 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/diplomatie/togo-le-president-burkinabe-roch-kabore-annule-son-voyage-sur-lome" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.250.162.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.197.174
country_id: 1269750
description:
Jun 20 00:21:24 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.197.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.147.59.225
country_id: 2635167
description:
[2026-06-20 00:20:32 +0000] info [whostmgrd] 147.147.59.225 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-20 00:22:52 +0000] info [cpaneld] 181.113.114.61 - cloudetr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-20 00:23:38 +0000] info [cpaneld] 103.65.237.227 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 60.50.34.202
country_id: 1733045
description:
60.50.34.202 - - [20/Jun/2026:00:24:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201046&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Faboudou-assouma-etait-un-monument-du-paysage-constitutionnel-du-togo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781915052 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/aboudou-assouma-etait-un-monument-du-paysage-constitutionnel-du-togo" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:60.50.34.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.115.56
country_id: 3469034
description:
Jun 20 00:26:35 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.115.56 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:28:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.91
country_id: 2395170
description:
Jun 20 00:28:25 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.199.236.246
country_id: 1282988
description:
113.199.236.246 - - [20/Jun/2026:00:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593636&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Ftogo-22-personnes-interpellees-lors-dune-operation-dans-les-lacs&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781915275 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/societe/togo-22-personnes-interpellees-lors-dune-operation-dans-les-lacs" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.199.236.246


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:28:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.162
country_id: 798544
description:
Jun 20 00:29:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.91
country_id: 2395170
description:
Jun 20 00:28:32 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:28:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13275753&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781915330 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:00:28:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12739682&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781915333 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:00:28:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723787&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781915334 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.159
country_id: 798544
description:
Jun 20 00:29:49 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 20 00:30:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.162
country_id: 798544
description:
Jun 20 00:29:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.162 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.87
country_id: 2635167
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:204.217.245.87||TA:204.217.245.87||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.202.167
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/39.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jun 20 00:32:45 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 105.113.82.220
country_id: 2328926
domain: dagl.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/communes/www.lomegolfe3.com||User:myxlsnta||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-35.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.12.204
country_id: 3077311
description:
Jun 20 00:40:34 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.12.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.91.202
country_id: 6252001
description:
[2026-06-20 00:42:28 +0000] info [cpaneld] 82.40.91.202 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:42:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:42:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.203.137.28
country_id: 3077311
description:
Jun 20 00:43:07 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.203.137.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.175
country_id: 3469034
description:
Jun 20 00:43:37 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:43:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10341273&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781916219 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.50
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-43.206.232.2.50||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:00:43:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907498&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781916223 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:45:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934995&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781916311 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:00:45:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274499&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781916311 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 20 00:44:47 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 20 00:44:55 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.222.130.225
country_id: 241170
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221225-WA0196-768x512.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.85.129
country_id: 6252001
description:
[2026-06-20 00:51:40 +0000] info [cpaneld] 82.40.85.129 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.191.232.255
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/exclusivite-interview-du-docteur-joy-puentes-chef-de-la-delegation-cubaine-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 00:54:43 +0000] info [cpaneld] 152.42.200.110 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:56:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:00:56:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.159
country_id: 798544
description:
Jun 20 00:57:53 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.190.250.31
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/554c4e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:01:00:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235739&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781917213 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:00:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328940&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781917212 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:02:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711149&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781917341 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:01:02:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132327&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781917343 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.169.213.211
country_id: 732800
description:
Jun 20 01:01:47 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.169.213.211 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.191.46
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/region-maritime-zio-affiche-des-indicateurs-sanitaires-en-forte-progression/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.191.46
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/region-maritime-zio-affiche-des-indicateurs-sanitaires-en-forte-progression/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.49.79.103
country_id: 2661886
description:
[2026-06-20 01:02:33 +0000] info [cpaneld] 13.49.79.103 - pduusmyf "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.187.129.40
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/611357593 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.239.47.1
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/chronique-n37-du-23-aout-2019 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.79.188.91
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/shelter-afrique-a-recu-92-millions-de-dollars-en-capital-supplementaire-du-kenya HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.217.197.27
country_id: 241170
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/t\xc3\xa9l\xc3\xa9chargement-11.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.100
country_id: 3469034
description:
Jun 20 01:08:00 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.62
country_id: 3865483
description:
Jun 20 01:10:17 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.62
country_id: 3865483
description:
Jun 20 01:10:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.213.103
country_id: 614540
description:
Jun 20 01:12:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.213.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.88
country_id: 3469034
description:
Jun 20 01:13:03 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.36.196.204
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/autonomisation-des-jeunes-filles-au-togo-le-projet-girl-emporwerment-lance-a-kara HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.178.74.245
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/yawa-kouigan-elue-vice-presidente-du-cct-uemoa HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.10.101.226
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/amelioration-de-la-sante-de-reproduction-les-capacites-des-acteurs-renforcees/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.9.193.202
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-secteur-aeroportuaire-togolais-passe-par-toutes-les-evolutions HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.213.103
country_id: 614540
description:
Jun 20 01:12:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.213.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.37.41
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/hommage-du-peuple-togolais-au-pere-de-la-nation/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:14:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:14:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 20 01:15:11 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:01:15:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684679&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781918121 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:15:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884332&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781918121 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:17:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6605203&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781918237 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:01:17:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922968&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781918237 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.86.56.40
country_id: 1282988
description:
103.86.56.40 - - [20/Jun/2026:01:16:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276270&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcybersecurite-le-togo-tient-sa-strategie-quinquennale%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781918190 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cybersecurite-le-togo-tient-sa-strategie-quinquennale/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.86.56.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.156.102.16
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sante-le-togo-reduit-la-mortalite-maternelle-et-neonatale HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.224.150
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1733910163 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.138.159.183
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=16183 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.161.215
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-filiale-dassurance-dafreximbank-afrexinsure-securise-sa-premiere-transaction HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.126.213.207
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=16072 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 91.92.40.207
country_id: 732800
description:
Jun 20 01:22:05 ns5 pure-ftpd[202428]: (?@91.92.40.207) [WARNING] Authentication failed for user [anonymous:anonymous]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.27.137
country_id: 2750405
description:
[2026-06-20 01:22:56 +0000] info [cpaneld] 195.63.27.137 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.65
country_id: 6251999
description:
[2026-06-20 01:22:55 +0000] info [cpaneld] 195.63.16.65 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.79
country_id: 2661886
description:
Jun 20 01:23:13 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.79
country_id: 2661886
description:
2026-06-20 01:23:15 dovecot_plain authenticator failed for H=tor-exit-read-me.dfri.se (bjddlw51jhxzs976u38n5z8zao4q557) [171.25.193.79]:9712: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.87.27
country_id: 2750405
description:
[2026-06-20 01:22:54 +0000] info [cpaneld] 217.181.87.27 - support.technique@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 20 01:24:05 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 20 01:25:12 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 20 01:26:03 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.14.161
country_id: 2017370
description:
Jun 20 01:26:25 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.14.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 01:26:43 +0000] info [cpaneld] 152.42.200.110 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 20 01:26:41 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.203
country_id: 690791
description:
Jun 20 01:27:01 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.34
country_id: 3865483
description:
Jun 20 01:27:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.74
country_id: 3469034
description:
Jun 20 01:27:32 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.61.209
country_id: 3469034
description:
Jun 20 01:29:01 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.239.145.233
country_id: 798544
description:
Jun 20 01:28:40 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.239.145.233 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:28:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:28:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 20 01:30:27 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:01:30:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196066&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919041 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:30:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946003&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919043 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.235
country_id: 2661886
description:
Jun 20 01:31:03 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.235
country_id: 2661886
description:
2026-06-20 01:31:05 dovecot_plain authenticator failed for H=tor-exit-read-me.dfri.se (is2zoqqjc3wwapcn7ca8b) [171.25.193.235]:7792: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:01:31:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938853&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919068 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 172.245.229.143
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:ellisplant69||Email:markbrown8322a92e@b.budgetthailandtravel.com||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.245.229.143
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-35.172.245.229.143||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [20/Jun/2026:01:35:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710427&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftrafic-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919357 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/trafic-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-41.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:43:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:43:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:45:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143131&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919904 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:01:45:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194005&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919902 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:01:45:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870439&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919934 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-06-20 01:45:53 +0000] info [cpaneld] 144.91.125.41 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:45:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918760&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781919933 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.103.31.168
country_id: 3625428
description:
190.103.31.168 - - [20/Jun/2026:01:47:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998121&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Fmifa-le-fida-envoie-une-mission-a-lome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781920021 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/economie/mifa-le-fida-envoie-une-mission-a-lome" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.103.31.168


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.104.195.175
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/303231652 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.87.92.36
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/709468438 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.237.132
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1876343761 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.68.108
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1167016131 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 01:53:44 +0000] info [cpaneld] 185.55.240.13 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.157
country_id: 6252001
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.868646330588855.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.235
country_id: 1269750
description:
Jun 20 01:54:49 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.180.100.76
country_id: 3469034
description:
Jun 20 01:55:10 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.180.100.76 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.138.173.93
country_id: 1210997
description:
103.138.173.93 - - [20/Jun/2026:01:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118440&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-decentralisation-bat-fort-dans-le-haho&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781920467 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-decentralisation-bat-fort-dans-le-haho" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.138.173.93


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.201
country_id: 2921044
description:
[2026-06-20 01:54:29 +0000] info [cpaneld] 5.175.229.201 NEW cinemafreenetmas:gOtEWFyuXer3CIic address=5.175.229.201,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.99.236.183
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/images-2.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2024/10/images-2-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.196
country_id: 690791
description:
Jun 20 01:57:22 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.196
country_id: 690791
description:
Jun 20 01:57:29 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 20 01:57:59 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:01:58:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986857&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781920700 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:59:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067302&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781920759 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:59:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:01:59:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.184.80.190
country_id: 3469034
description:
Jun 20 01:59:21 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.184.80.190 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:01:59:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251415&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781920764 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.184.80.190
country_id: 3469034
description:
Jun 20 01:59:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.184.80.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.162.99.230
country_id: 3077311
description:
Jun 20 01:59:51 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.162.99.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.142.83.58
country_id: 2542007
description:
41.142.83.58 - - [20/Jun/2026:01:59:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788756&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-233353retidm28der.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781920794 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-233353retidm28der.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.142.83.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.209
country_id: 3865483
description:
Jun 20 02:02:42 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.84.76
country_id: 6252001
description:
[2026-06-20 02:03:37 +0000] info [cpaneld] 82.40.84.76 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [20/Jun/2026:02:03:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275742&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921032 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jun 20 02:04:49 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.249.133
country_id: 3469034
description:
Jun 20 02:06:42 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.249.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.18
country_id: 1269750
description:
Jun 20 02:07:12 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 193.221.201.93
country_id: 2017370
description:
2026-06-20 02:10:16 H=([193.221.201.93]) [193.221.201.93]:13744 F=<sarah@futurhealth.living> rejected RCPT <kumar@white-ways.com>: The mail server could not deliver mail to kumar@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 20 02:11:13 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 20 02:12:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.173
country_id: 2300660
description:
Jun 20 02:13:05 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.173 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:13:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277897&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921598 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:13:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988453&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921608 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.181
country_id: 732800
description:
Jun 20 02:13:37 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.181 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:13:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314632&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921617 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:13:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923173&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921617 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:15:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:15:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.206
country_id: 3469034
description:
Jun 20 02:16:07 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.225
country_id: 690791
description:
Jun 20 02:16:04 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.141.32
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/concours-de-recrutement-a-lotr-les-resultats-disponibles-depuis-ce-1er-fevrier/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:22:20 +0000] info [cpaneld] 185.55.240.13 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.6.245
country_id: 3932488
description:
179.6.6.245 - - [20/Jun/2026:02:22:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750675&pdata=https%253A%252F%252Ftogodailynews.tg%252Falain-jean-giresse-et-la-tunisie-chassent-le-chat-noir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922145 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/alain-jean-giresse-et-la-tunisie-chassent-le-chat-noir/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.5516.1270 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.6.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.95.15
country_id: 6252001
description:
[2026-06-20 02:23:04 +0000] info [cpaneld] 82.40.95.15 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:24:07 +0000] info [cpaneld] 185.55.240.13 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.64.7
country_id: 2017370
description:
45.91.64.7 - - [20/Jun/2026:02:24:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896367&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922296 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.7


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.91.64.8
country_id: 2017370
description:
45.91.64.8 - - [20/Jun/2026:02:25:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789269&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922299 HTTP/2.0" 404 561 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.8


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.91.64.8
country_id: 2017370
description:
45.91.64.8 - - [20/Jun/2026:02:25:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 154.70.82.246 "https://154.70.82.246/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789269&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922299" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.8


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.91.64.6
country_id: 2017370
description:
45.91.64.6 - - [20/Jun/2026:02:25:18 +0000] "GET /favicon.ico HTTP/1.1" 415 587 154.70.82.246 "https://154.70.82.246/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789269&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922299" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.6


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.209.149.107
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.29.235
country_id: 2542007
description:
[2026-06-20 02:24:52 +0000] info [cpaneld] 41.141.29.235 - kvwytkkw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kvwytkkw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:27:11 +0000] info [cpaneld] 185.55.240.13 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.129.55
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-29.191.102.129.55||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:30:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606814&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922613 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:30:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065565&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922614 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:30:50 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 209.50.187.100
country_id: 6251999
domain: metaart.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.114.103.42
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 104.207.33.159
country_id: 6252001
domain: metaart.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 209.50.187.100
country_id: 6251999
domain: metaart.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.171.171.97
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:31:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199768&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922697 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:31:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067669&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922697 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.171.171.97
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:32:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:32:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:33:07 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.150.139
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.38.97.215
country_id: 2750405
description:
[2026-06-20 02:35:02 +0000] info [cpaneld] 89.38.97.215 - nwvfmxat "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:38:08 +0000] info [cpaneld] 195.3.220.88 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 204.217.131.12
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-39.204.217.131.12||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.79
country_id: 3469034
description:
Jun 20 02:41:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.79
country_id: 3469034
description:
Jun 20 02:41:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.219.166.171
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/09/027981ec990f556d8370a14e3e774061_XL.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2020/09/027981ec990f556d8370a14e3e774061_XL-300x204.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.100.145.105
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/08/WhatsApp-Image-2022-08-14-at-15.28.49-1.jpeg 512w, http:/togodailynews.tg/wp-content/uploads/2022/08/WhatsApp-Image-2022-08-14-at-15.28.49-1-300x169.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/08/WhatsApp-Image-2022-08-14-at-15.28.49-1-510x288.jpeg 510w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.61.244.30
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/86163050 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.50.239.192
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/pharmacie-indre-et-loire-beaulieu-les-loches-960x640-960x640-1-960x630-1.webp 960w, http:/togodailynews.tg/wp-content/uploads/2025/03/pharmacie-indre-et-loire-beaulieu-les-loches-960x640-960x640-1-960x630-1-300x197.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/03/pharmacie-indre-et-loire-beaulieu-les-loches-960x640-960x640-1-960x630-1-768x504.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.188.109
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:191.101.188.109||TA:191.101.188.109||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.125
country_id: 798544
description:
Jun 20 02:43:55 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.145
country_id: 3469034
description:
Jun 20 02:43:29 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.145 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:43:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923691&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923414 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:43:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131861&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923418 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.39.228.73
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG_20210928_094157_409.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.88.253.64
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/04/FB_IMG_1618986940410.jpg 720w, http:/togodailynews.tg/wp-content/uploads/2021/04/FB_IMG_1618986940410-300x170.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.56.66
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027.jpg 1040w, http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027-300x150.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027-768x384.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027-1024x512.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:46:37 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:46:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538646&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923598 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.42
country_id: 3469034
description:
Jun 20 02:46:57 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:46:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661334&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923594 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:48:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:48:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.14
country_id: 690791
description:
Jun 20 02:49:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:49:36 +0000] info [cpaneld] 195.3.220.88 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:50:19 +0000] info [cpaneld] 185.55.240.13 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.138.59.18
country_id: 2440476
description:
Jun 20 02:51:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.138.59.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.160
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.206.232.2.160||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.144
country_id: 3469034
description:
Jun 20 02:52:39 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.65.142
country_id: 3469034
description:
Jun 20 02:52:48 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.65.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.6.47.167
country_id: 3625428
description:
190.6.47.167 - - [20/Jun/2026:02:52:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6474136&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-delegation-de-shelter-afrique-rencontre-le-ministre-de-lhabitat-du-nigeria-avant-laga%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923969 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-delegation-de-shelter-afrique-rencontre-le-ministre-de-lhabitat-du-nigeria-avant-laga/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.6.47.167


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.212
country_id: 3469034
description:
Jun 20 02:53:11 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:52:29 +0000] info [cpaneld] 195.3.220.88 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:54:57 +0000] info [cpaneld] 195.3.220.88 - ecritoir "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ecritoir (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:55:34 +0000] info [cpaneld] 195.3.220.88 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 02:55:53 +0000] info [cpaneld] 152.42.200.110 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.76
country_id: 3469034
description:
Jun 20 02:55:56 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.76 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.187.114.97
country_id: 597427
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:193.187.114.97||TA:193.187.114.97||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:57:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393492&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924228 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:57:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169945&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924232 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:00:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:60139: 535 Incorrect authentication data (set_id=q)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674087&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924392 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:59:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842521&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924394 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 20 03:00:17 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.156
country_id: 298795
description:
Jun 20 03:00:43 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.132.30
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/Press-5G-part1-250F_TogodayliNews.webp 970w, http:/togodailynews.tg/wp-content/uploads/2025/03/Press-5G-part1-250F_TogodayliNews-300x28.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/03/Press-5G-part1-250F_TogodayliNews-768x71.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:01:56 +0000] info [cpaneld] 195.3.220.88 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:02:46 +0000] info [cpaneld] 195.3.220.88 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.175.160
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:revue-annuelle-des-reformes-communautaire-de-luemoa-lauto-evaluation-tenue-a-lome/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:04:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:04:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:04:22 +0000] info [cpaneld] 195.3.220.88 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.22
country_id: 1269750
description:
Jun 20 03:03:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:04:47 +0000] info [cpaneld] 195.3.220.88 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:05:32 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:05:55 +0000] info [cpaneld] 195.3.220.88 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.21.182
country_id: 3865483
description:
Jun 20 03:06:03 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.21.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:06:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:43516: 535 Incorrect authentication data (set_id=klaudia1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 20 03:06:55 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 03:08:07 +0000] info [cpaneld] 185.55.240.13 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.227
country_id: 3469034
description:
Jun 20 03:10:03 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.194.230.10
country_id: 3996063
description:
Jun 20 03:10:24 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.194.230.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.83
country_id: 3175395
description:
Jun 20 03:10:02 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.194.230.10
country_id: 3996063
description:
Jun 20 03:10:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.194.230.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:12:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6922140&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925119 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:12:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853528&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925121 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.130.201
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/bcb3a7 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:13:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:24187: 535 Incorrect authentication data (set_id=contacts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.230
country_id: 3469034
description:
Jun 20 03:13:57 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.85.189
country_id: 3865483
description:
Jun 20 03:14:46 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 20 03:14:32 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:03:15:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261864&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925330 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:15:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116740&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925332 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.163
country_id: 3469034
description:
Jun 20 03:16:50 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:20:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:30731: 535 Incorrect authentication data (set_id=12121946)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:20:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:20:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.100.98
country_id: 6252001
description:
[2026-06-20 03:20:45 +0000] info [cpaneld] 82.40.100.98 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.93
country_id: 3469034
description:
Jun 20 03:21:55 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jun 20 03:22:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.190
country_id: 3175395
description:
Jun 20 03:23:02 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jun 20 03:22:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.114
country_id: 3175395
description:
Jun 20 03:24:49 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:25:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856155&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925948 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:25:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262378&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925951 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:27:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:23052: 535 Incorrect authentication data (set_id=ara)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 20 03:27:00 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.74.177
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/5e4f41 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.247.115
country_id: 3469034
description:
Jun 20 03:27:38 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.247.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.127.3
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.127.3
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun 20 03:28:33 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.155
country_id: 298795
description:
Jun 20 03:29:18 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.155
country_id: 298795
description:
Jun 20 03:29:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 03:29:30 +0000] info [cpaneld] 185.55.240.13 - wao@waotherapy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.85.187
country_id: 3865483
description:
Jun 20 03:29:53 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.85.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 20 03:32:00 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:32:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920805&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926324 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:03:32:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674138&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926327 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.222.63.213
country_id: 99237
description:
176.222.63.213 - - [20/Jun/2026:03:32:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132841&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecomposition-de-la-ceni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926366 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recomposition-de-la-ceni/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.5975.1817 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.222.63.213


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.192.110.73
country_id: 1819730
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/photo-8-mars-2-768x615.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.12.250
country_id: 3469034
description:
Jun 20 03:35:45 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.12.250 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:37:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.83.124.76
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/953695906 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:37:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.91
country_id: 298795
description:
Jun 20 03:38:10 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.216
country_id: 2395170
description:
Jun 20 03:38:11 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 03:38:24 +0000] info [cpaneld] 185.55.240.13 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.66
country_id: 933860
description:
Jun 20 03:38:51 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.87
country_id: 798544
description:
Jun 20 03:39:07 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.137
country_id: 3865483
description:
Jun 20 03:38:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.184
country_id: 1269750
description:
Jun 20 03:40:22 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.184 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.222.196.104
country_id: 1814991
description:
54.222.196.104 - - [20/Jun/2026:03:39:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259548&pdata=https%253A%252F%252Ftogodailynews.tg%252Facces-a-leau-potable-pour-tous-victoire-tomegah-dogbe-visite-3-chantiers-de-construction-de-chateau-deau-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926767 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/acces-a-leau-potable-pour-tous-victoire-tomegah-dogbe-visite-3-chantiers-de-construction-de-chateau-deau-a-lome/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.7376.1531 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.222.196.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.184
country_id: 1269750
description:
Jun 20 03:40:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.178
country_id: 798544
description:
Jun 20 03:40:41 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.90.118.19
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/278172457 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:41:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262676&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926912 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:42:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118746&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926915 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.165.121
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:199.96.165.121||TA:199.96.165.121||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jun 20 03:43:36 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:45:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671831&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927144 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:03:45:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723436&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927144 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 34.221.200.0
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.221.200.0/azenv4.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.83.40.99
country_id: 1643084
description:
203.83.40.99 - - [20/Jun/2026:03:48:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10056293&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcua-au-kenya-edem-tengue-appelle-a-des-mesures-concretes-contre-la-peche-inn-en-afrique&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927298 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cua-au-kenya-edem-tengue-appelle-a-des-mesures-concretes-contre-la-peche-inn-en-afrique" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.83.40.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.252
country_id: 1269750
description:
Jun 20 03:48:38 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jun 20 03:49:57 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.171.107
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/b09789 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.255.47
country_id: 798544
description:
Jun 20 03:50:37 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.255.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.227.37
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46-768x432.webp 768w, http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46.webp 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:52:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:52:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.120.115.21
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/5a5243 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.169
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-52.206.232.2.169||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 20 03:53:03 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jun 20 03:53:57 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:55:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000030&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927737 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.193
country_id: 690791
description:
Jun 20 03:56:07 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.193 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.36.122.22
country_id: 1210997
description:
202.36.122.22 - - [20/Jun/2026:03:55:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027695&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fagoe-nyive-4-le-sort-du-maire-dans-les-mains-du-juge-administratif%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927736 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/agoe-nyive-4-le-sort-du-maire-dans-les-mains-du-juge-administratif/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.36.122.22


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776779&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927736 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77350441
name: IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 113.15.120.184
country_id: 1814991
domain: misstogo.tg
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:binance odkazov'y bonus||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.103
country_id: 3469034
description:
Jun 20 04:00:41 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.149.107.172
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/744273641 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:01:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212829&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928110 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:01:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196586&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928112 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.180.200.5
country_id: 1694008
description:
103.180.200.5 - - [20/Jun/2026:04:01:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724462&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14578&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928113 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14578" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.2269.1456 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.180.200.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 20 04:02:18 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 20 04:02:43 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 20 04:03:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.227.39
country_id: 1668284
description:
Jun 20 04:03:34 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.227.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.227.39
country_id: 1668284
description:
2026-06-20 04:03:36 dovecot_plain authenticator failed for H=(6jn732xkye2eaozftgsoi8ar81g148) [165.154.227.39]:42710: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.81.76
country_id: 6252001
description:
[2026-06-20 04:03:37 +0000] info [cpaneld] 82.40.81.76 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.13.69.103
country_id: 3175395
description:
Jun 20 04:03:57 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.13.69.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:05:32 +0000] info [cpaneld] 185.55.240.13 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.221.219.14
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/456c32 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.178.104
country_id: 732800
description:
Jun 20 04:07:00 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jun 20 04:07:40 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.201
country_id: 3469034
description:
Jun 20 04:07:42 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.37.22.147
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33.webp 1040w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33-300x135.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33-1024x461.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33-768x346.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:08:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:08:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
country_id: 1814991
description:
Jun 20 04:07:33 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:09:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027729&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928559 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jun 20 04:08:29 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.13.110.15
country_id: 3865483
description:
Jun 20 04:08:30 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.13.110.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.187
country_id: 690791
description:
Jun 20 04:09:09 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.187 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.187.66.220
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.55.161.43
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434.jpg 1280w, http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434-768x432.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434-1024x576.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:09:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315627&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928564 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.113.114.67
country_id: 1269750
description:
Jun 20 04:09:36 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.113.114.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.1
country_id: 3175395
description:
Jun 20 04:11:23 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.1
country_id: 3175395
description:
Jun 20 04:11:31 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.46
country_id: 953987
description:
Jun 20 04:11:29 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.136.149
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/91029270 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.232.51.223
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/MACHINE-860x452-1.webp 860w, http:/togodailynews.tg/wp-content/uploads/2026/02/MACHINE-860x452-1-300x158.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/MACHINE-860x452-1-768x404.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any sort of concerns concerning where and ways to make use of ||MV:gt;If you have any sort of concerns concerning where and ways to make use of ||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.233.252
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:66.146.233.252||TA:66.146.233.252||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.28.232
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/519931327 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 20 04:16:02 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:16:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158002&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928967 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:16:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6594201&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928968 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.171.176.156
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/655c54 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.245.93.35
country_id: 1282988
description:
43.245.93.35 - - [20/Jun/2026:04:15:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197864&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Frentree-du-2-novembre-au-togo-les-eleves-seront-30-et-60-par-classe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928956 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/rentree-du-2-novembre-au-togo-les-eleves-seront-30-et-60-par-classe" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.245.93.35


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.119.34.87
country_id: 1282988
description:
111.119.34.87 - - [20/Jun/2026:04:16:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918807&pdata=https%253A%252F%252Ftogodailynews.tg%252Fecobank-au-dessus-des-2-milliards-de-dollars-de-revenus-en-2023&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928961 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ecobank-au-dessus-des-2-milliards-de-dollars-de-revenus-en-2023" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.119.34.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.94.184
country_id: 99237
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/developpement-inclusif-le-duo-togo-pnud-est-tres-gagnant/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.94.184
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/developpement-inclusif-le-duo-togo-pnud-est-tres-gagnant/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.232.64.199
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/made-in-togo-victoire-tomegah-dogbe-visite-la-soproem/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 152.39.229.96
country_id: 6252001
domain: ekeasarl.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/106.0.5249.30 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.92
country_id: 1269750
description:
Jun 20 04:20:14 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.92
country_id: 1269750
description:
Jun 20 04:20:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.92 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.213.72
country_id: 1733045
description:
113.211.213.72 - - [20/Jun/2026:04:20:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142577&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Ftogo-compte-rendu-du-conseil-des-ministres-du-24-mars-2021&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929249 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/togo-compte-rendu-du-conseil-des-ministres-du-24-mars-2021" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.213.72


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:23:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:23:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 20 04:24:36 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.211
country_id: 3469034
description:
Jun 20 04:24:59 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.64.35
country_id: 6252001
description:
[2026-06-20 04:25:12 +0000] info [cpaneld] 82.40.64.35 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.176
country_id: 2300660
description:
Jun 20 04:25:20 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:25:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804643&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929530 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:25:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169639&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929531 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.2
country_id: 3469034
description:
Jun 20 04:25:42 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.104
country_id: 2413451
description:
Jun 20 04:27:17 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.104 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:30:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195867&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929856 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:30:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984606&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929857 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.146.172.113
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34-1024x461.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34-300x135.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34-768x346.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34.webp 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.104.194
country_id: 6252001
description:
[2026-06-20 04:32:31 +0000] info [cpaneld] 82.40.104.194 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.118.60
country_id: 6252001
description:
[2026-06-20 04:33:06 +0000] info [cpaneld] 82.40.118.60 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.143.23
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL.jpg 1600w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-1024x682.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-1536x1023.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [20/Jun/2026:04:34:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460615&pdata=http%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930077 HTTP/1.1" 302 0 sthandling-aero.tg "http://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [20/Jun/2026:04:35:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105384&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930134 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 04:35:37 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.105.21
country_id: 3469034
description:
Jun 20 04:36:18 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.105.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.105.21
country_id: 3469034
description:
Jun 20 04:36:33 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.105.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:36:39 +0000] info [cpaneld] 185.55.240.13 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.182
country_id: 3469034
description:
Jun 20 04:36:49 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jun 20 04:37:54 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:37:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.226.74
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1084471188 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:37:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313776&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930467 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302506&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930465 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.59.81.134
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/Diplomatie-Trois-nouveaux-ambassadeurs-accredites-au-Togo.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/10/Diplomatie-Trois-nouveaux-ambassadeurs-accredites-au-Togo-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/Diplomatie-Trois-nouveaux-ambassadeurs-accredites-au-Togo-768x615.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.215.139.227
country_id: 6252001
description:
[2026-06-20 04:44:28 +0000] info [cpaneld] 69.215.139.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.206.103.129
country_id: 6252001
description:
[2026-06-20 04:44:36 +0000] info [cpaneld] 72.206.103.129 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.118.106
country_id: 6252001
description:
[2026-06-20 04:44:39 +0000] info [cpaneld] 98.97.118.106 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 20 04:46:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:45:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922663&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930749 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:45:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526406&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930749 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 20 04:45:55 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.44.213
country_id: 6252001
description:
[2026-06-20 04:48:12 +0000] info [cpaneld] 104.207.44.213 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-47.213.32.21.59||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.214.37.106
country_id: 2264397
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:181.214.37.106||TA:181.214.37.106||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.23.4
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39-1024x672.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39-300x197.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39-768x504.webp 768w, http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39.webp 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:51:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:51:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.249.55.245
country_id: 1269750
description:
Jun 20 04:51:15 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.249.55.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 20 04:50:30 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.167.229.239
country_id: 1282988
description:
103.167.229.239 - - [20/Jun/2026:04:52:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382694&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Ffaure-gnassingbe-et-le-gouvernement-en-seminaire-a-kpalime&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931160 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/societe/faure-gnassingbe-et-le-gouvernement-en-seminaire-a-kpalime" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.167.229.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.247.246
country_id: 99237
description:
Jun 20 04:53:53 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.247.246 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:55:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069417&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931312 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923989&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931327 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 20 04:56:10 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 20 04:57:22 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:56:43 +0000] info [cpaneld] 185.55.240.13 - admin@togocarrierebetons.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:57:42 +0000] info [cpaneld] 185.55.240.13 - solarplusafrique.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user solarplusafrique.com (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.34
country_id: 2635167
description:
[2026-06-20 04:58:48 +0000] info [cpaneld] 5.230.133.34 NEW mbyqtkiw:4BtKHx3LggWZAqPI address=5.230.133.34,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:01:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804138&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931696 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:01:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985368&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931696 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 20 05:03:26 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.141
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/Le-President-du-Conseil-Faure-Essozimna-Gnassingbe-a-recu-ce-18-mai-2026-une-delegation-ministerielle-polonaise-conduite-par-le-Vice-Premier-ministre-et-ministre-des-Affaires-numeriques.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/05/Le-President-du-Conseil-Faure-Essozimna-Gnassingbe-a-recu-ce-18-mai-2026-une-delegation-ministerielle-polonaise-conduite-par-le-Vice-Premier-ministre-et-ministre-des-Affaires-numeriques-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/Le-President-du-Conseil-Faure-Essozimna-Gnassingbe-a-recu-ce-18-mai-2026-une-delegation-ministerielle-polonaise-conduite-par-le-Vice-Premier-ministre-et-ministre-des-Affaires-numeriques-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.195.114.184
country_id: 6252001
description:
Jun 20 05:06:43 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.195.114.184 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:07:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:07:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:11:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383257&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932265 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:11:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869762&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932266 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.172.121.173
country_id: 3996063
description:
187.172.121.173 - - [20/Jun/2026:05:11:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6451097&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10934&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932283 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10934" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9787.1631 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.172.121.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jun 20 05:14:03 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.198.21
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-la-jeune-fille-est-bien-maintenue-dans-le-systeme-scolaire/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:15:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315886&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932550 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:15:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924969&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932547 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.79.184.65
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-1536x1152.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3.jpg 1600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.203
country_id: 3175395
description:
Jun 20 05:17:29 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.185
country_id: 1269750
description:
Jun 20 05:21:12 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.71.17.215
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-22.45.71.17.215||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:23:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:23:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.47.32.253
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1125820244 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.163.45
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.163.45
country_id: 290557
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.104.28.138
country_id: 1282988
description:
103.104.28.138 - - [20/Jun/2026:05:24:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054042&pdata=https%253A%252F%252Fcpanel.turkdef.free.netmaster.tg%252F%253Flocale%253Dko&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933095 HTTP/2.0" 302 0 cpanel.turkdef.free.netmaster.tg "https://cpanel.turkdef.free.netmaster.tg/?locale=ko" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.104.28.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.42.178.81
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/347504473 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-06-20 05:25:45 dovecot_plain authenticator failed for H=(autalia) [64.72.74.162]:51775: 535 Incorrect authentication data (set_id=57936965@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:25:49 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:11476: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.8
country_id: 2395170
description:
Jun 20 05:26:01 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:26:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711402&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933176 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:26:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119532&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933167 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.78.39.6
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/615863674 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.25.57.192
country_id: 3932488
description:
38.25.57.192 - - [20/Jun/2026:05:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104105&pdata=https%253A%252F%252Fcpanel.turkdef.free.netmaster.tg%252F%253Flocale%253Dfi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933266 HTTP/2.0" 302 0 cpanel.turkdef.free.netmaster.tg "https://cpanel.turkdef.free.netmaster.tg/?locale=fi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.25.57.192


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.53.240
country_id: 1269750
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/jzo-rain-2017/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:29:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935205&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933352 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:29:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119274&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933354 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 165.227.227.95
country_id: 2635167
description:
165.227.227.95 - - [20/Jun/2026:05:30:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853784&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYy5hb3VkZS5jQHJjdS5nb3Yuc2E%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933402 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Yy5hb3VkZS5jQHJjdS5nb3Yuc2E=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:165.227.227.95


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:30:27 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:12953: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:31:31 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:9488: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:33:28 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:9971: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.222
country_id: 690791
description:
Jun 20 05:34:22 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.74
country_id: 3865483
description:
Jun 20 05:34:47 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.222
country_id: 690791
description:
Jun 20 05:34:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.33.241
country_id: 1269750
description:
Jun 20 05:35:01 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.33.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-06-20 05:35:03 dovecot_login authenticator failed for H=([125.17.70.25]) [128.185.33.241]:43719: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:38:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:38:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.7.71.181
country_id: 2750405
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 74.63.204.214
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:silasmessier189||Email:gseotier2@xmc.pl||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:42:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6383980&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934165 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:42:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247766&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934158 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 121.200.221.124
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/01/c9f88ad4007ec3ae53e51c9dece3e6a9_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2022/01/c9f88ad4007ec3ae53e51c9dece3e6a9_L-300x201.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/01/c9f88ad4007ec3ae53e51c9dece3e6a9_L-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.107
country_id: 3469034
description:
Jun 20 05:44:53 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 197.239.11.93
country_id: 226074
description:
[2026-06-20 05:45:31 +0000] info [cpaneld] 197.239.11.93 - pnls "POST /cpsess2500151008/3rdparty/phpMyAdmin/index.php?route=/ HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [197.239.9.110] != Current IP Address [197.239.11.93]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.190.194.14
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502-300x173.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502-768x443.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502-1024x591.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:46:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604948&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934403 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-06-20 05:47:30 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl (fides217.static.host.gvt.net.br) [89.67.37.52]:57561: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-06-20 05:47:39 dovecot_login authenticator failed for H=([65.20.251.41]) [182.73.109.194]:34612: 535 Incorrect authentication data (set_id=phipa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.176
country_id: 6251999
description:
[2026-06-20 05:47:56 +0000] info [cpaneld] 217.181.81.176 - pmalabvi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.133.74.53
country_id: 2921044
description:
45.133.74.53 - ruuwezvf [20/Jun/2026:05:49:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092713&pdata=https%253A%252F%252Fmafisteel.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934573 HTTP/2.0" 302 0 mafisteel.tg "https://mafisteel.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.133.74.53


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.44.104.97
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1265786419 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:52:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:52:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.62.143
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.239
country_id: 3469034
description:
Jun 20 05:55:09 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.239 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:56:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131605&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934976 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.12
country_id: 798544
description:
Jun 20 05:55:27 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.238.186
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/119388902 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:56:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800745&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934981 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:56:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935215&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934989 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.201.87.172
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/7d6e79 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.168.112
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/464210875 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.33.130.102
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [20/Jun/2026:06:00:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841494&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935226 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.249.55.245
country_id: 1269750
description:
Jun 20 06:01:20 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.249.55.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:00:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066586&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935232 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:00:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261401&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935231 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.108.99
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1536x1024.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1.webp 1600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.41.178
country_id: 2077456
description:
2026-06-20 06:03:02 dovecot_login authenticator failed for H=110-175-41-178.static.tpgi.com.au ([111.70.34.159]) [110.175.41.178]:60017: 535 Incorrect authentication data (set_id=apoyo@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.34.84
country_id: 1835841
description:
Jun 20 06:03:17 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.34.84
country_id: 1835841
description:
2026-06-20 06:03:19 dovecot_login authenticator failed for H=([74.192.225.229]) [222.116.34.84]:58952: 535 Incorrect authentication data (set_id=apoyo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.62.144
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034.jpg 1560w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.223.125.4
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1557927673 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:07:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:07:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.29.214.190
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c7c3c6 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.112.99.52
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.209
country_id: 953987
description:
Jun 20 06:08:14 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.209 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [20/Jun/2026:06:08:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738435&pdata=http%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935716 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.148.161.154
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/a99b98 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-06-20 06:10:32 dovecot_login authenticator failed for H=([197.219.228.246]) [182.95.181.138]:38936: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.234.34.244
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/809395184 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:13:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081966&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935993 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.104.224
country_id: 6252001
description:
[2026-06-20 06:14:25 +0000] info [cpaneld] 82.40.104.224 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:15:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844055&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936156 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:16:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854758&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936159 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.26.11.81
country_id: 6252001
description:
2026-06-20 06:18:23 dovecot_login authenticator failed for H=([14.51.223.171]) [2.26.11.81]:12480: 535 Incorrect authentication data (set_id=office@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.91.85
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/367103630 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.186.201.192
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/60738b-le-togo-et-la-banque-mondiale-scellent-le-financement-du-corridor-conomique-lom-ouagadougou-niamey-ocb-1.png 499w, http:/togodailynews.tg/wp-content/uploads/2021/10/60738b-le-togo-et-la-banque-mondiale-scellent-le-financement-du-corridor-conomique-lom-ouagadougou-niamey-ocb-1-300x200.png 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/60738b-le-togo-et-la-banque-mondiale-scellent-le-financement-du-corridor-conomique-lom-ouagadougou-niamey-ocb-1-272x182.png 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.191
country_id: 2017370
description:
2026-06-20 06:18:48 dovecot_login authenticator failed for H=78da6e9876c8.mldns.ru ([178.71.9.121]) [109.72.235.191]:60456: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.213.181.250
country_id: 6252001
description:
2026-06-20 06:19:03 dovecot_login authenticator failed for H=250.sub-97-213-181.myvzw.com ([111.70.34.159]) [97.213.181.250]:49782: 535 Incorrect authentication data (set_id=stephane.o)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.53.178.235
country_id: 2017370
description:
2026-06-20 06:18:32 dovecot_login authenticator failed for H=([197.167.169.179]) [95.53.178.235]:40620: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.70.207
country_id: 2017370
description:
2026-06-20 06:19:54 dovecot_login authenticator failed for H=([186.5.180.176]) [31.173.70.207]:29240: 535 Incorrect authentication data (set_id=admin@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.104.70.143
country_id: 2017370
description:
2026-06-20 06:20:04 dovecot_login authenticator failed for H=([41.70.94.2]) [212.104.70.143]:57834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-20 06:20:45 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.196.175.213
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1899440673 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.247
country_id: 690791
description:
Jun 20 06:22:45 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.193.164.206
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14-1024x663.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14-300x194.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14-768x497.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14.webp 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:24:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:24:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.71.44
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/818688 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.66.184
country_id: 6252001
description:
[2026-06-20 06:27:48 +0000] info [cpaneld] 82.40.66.184 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:28:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382743&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936938 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:29:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7431835&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936941 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:31:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792358&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937082 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:31:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542554&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937084 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 06:32:17 +0000] info [cpaneld] 185.55.240.13 - .SAPHYRTOUR "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.183.58.200
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/91867b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.4.144
country_id: 953987
description:
2026-06-20 06:33:59 dovecot_login authenticator failed for H=([203.110.89.205]) [154.73.4.144]:46193: 535 Incorrect authentication data (set_id=dnador@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.34.84
country_id: 1835841
description:
2026-06-20 06:34:28 dovecot_login authenticator failed for H=([183.171.49.144]) [222.116.34.84]:35381: 535 Incorrect authentication data (set_id=dnador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-06-20 06:36:02 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:50738: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.207.214
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.79.249.33
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/eXgNVviq5wiNeYmBcDx5BamWpcYWrlop5qBt9PoJ.webp 824w, http:/togodailynews.tg/wp-content/uploads/2025/10/eXgNVviq5wiNeYmBcDx5BamWpcYWrlop5qBt9PoJ-300x196.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/eXgNVviq5wiNeYmBcDx5BamWpcYWrlop5qBt9PoJ-768x502.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.103.149
country_id: 2077456
description:
Jun 20 06:39:45 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.103.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.103.149
country_id: 2077456
description:
2026-06-20 06:39:47 dovecot_login authenticator failed for H=([170.39.151.178]) [58.84.103.149]:55233: 535 Incorrect authentication data (set_id=martine@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.122.32
country_id: 130758
description:
2026-06-20 06:40:01 dovecot_login authenticator failed for H=([119.51.237.123]) [213.176.122.32]:57566: 535 Incorrect authentication data (set_id=martine)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:39:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.176.122.32
country_id: 130758
description:
Jun 20 06:39:59 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.176.122.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:39:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.152.52.25
country_id: 2464461
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:257d03eb5416e9e51cc9c623ca1af6fcad319ad4||Title:5sbtnzgsl3i34lz84||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.141.91.2
country_id: 1835841
description:
2026-06-20 06:44:06 dovecot_login authenticator failed for H=([142.160.240.20]) [58.141.91.2]:54931: 535 Incorrect authentication data (set_id=serge.a@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.141.91.2
country_id: 1835841
description:
Jun 20 06:44:04 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.141.91.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.232.37.145
country_id: 1562822
description:
2026-06-20 06:44:16 dovecot_login authenticator failed for H=([5.135.202.77]) [14.232.37.145]:45683: 535 Incorrect authentication data (set_id=serge.a)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:45:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660051&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937917 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:45:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13342920&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937917 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:46:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264999&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937973 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.152.52.25
country_id: 2464461
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2b39602455af0f6199d71460ad173b5e0a1892c||Title:hzedlycdghzltg75||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:46:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804441&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937972 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.237
country_id: 2395170
description:
Jun 20 06:48:07 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.50.106
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0007-696x608-1.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0007-696x608-1-300x262.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.167
country_id: 3469034
description:
Jun 20 06:49:03 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.152.30.75
country_id: 6252001
description:
[2026-06-20 06:49:24 +0000] info [cpaneld] 164.152.30.75 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.54.114
country_id: 226074
description:
Jun 20 06:49:25 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.54.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.54.114
country_id: 226074
description:
Jun 20 06:49:32 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.54.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.243
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2023\xc2\xa0: D\xc3\xa9but des luttes initiatiques en pr\xc3\xa9sence du chef de l\xe2\x80\x99\xc3\x89tat||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.127
country_id: 798544
description:
Jun 20 06:51:50 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.103.44
country_id: 798544
description:
Jun 20 06:52:26 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.103.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.86.108
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/colloque-scientifique-a-lome-medias-et-communication-pour-la-transition-ecologique/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.116
country_id: 690791
description:
Jun 20 06:52:27 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.137.187
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0004-1-1024x768-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0004-1-1024x768-1-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0004-1-1024x768-1-768x576.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 06:55:12 +0000] info [cpaneld] 185.55.240.13 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.251.86.65
country_id: 1210997
description:
Jun 20 06:57:02 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.251.86.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 88.238.192.5
country_id: 298795
domain: matwtogo.org
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:59:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459800&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938743 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:59:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248530&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938742 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.98.198.172
country_id: 290557
description:
92.98.198.172 - - [20/Jun/2026:06:59:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934187&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-letat-durgence-securitaire-proroge-dun-an-dans-la-region-des-savanes%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938763 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-letat-durgence-securitaire-proroge-dun-an-dans-la-region-des-savanes/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.98.198.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.236.98.157
country_id: 285570
description:
188.236.98.157 - - [20/Jun/2026:06:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380697&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-banque-centrale-de-tunisie-devient-le-treizieme-membre-du-papss&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938723 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-banque-centrale-de-tunisie-devient-le-treizieme-membre-du-papss" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.236.98.157


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-20 06:59:42 +0000] info [whostmgrd] 203.147.139.82 NEW root:uqVwwl7Dstq3P4xM address=203.147.139.82,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:_Oy0LhB9GoHskJ8u:create_user_session,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:59:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856618&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938762 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:01:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791843&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938871 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 157.66.87.98
country_id: 1643084
description:
157.66.87.98 - - [20/Jun/2026:07:00:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726402&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdemarrage-bientot-des-travaux-damenagement-de-la-depression-du-triangle-des-rails-a-tokoin-dogbeavou&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938852 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/demarrage-bientot-des-travaux-damenagement-de-la-depression-du-triangle-des-rails-a-tokoin-dogbeavou" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:157.66.87.98


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:01:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7377302&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938870 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.11
country_id: 3469034
description:
Jun 20 07:02:45 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-20 07:04:28 +0000] info [whostmgrd] 203.147.139.82 NEW arsetg:ntcMn8aMMBZsUq39 address=203.147.139.82,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-20 07:04:29 +0000] info [cpaneld] 203.147.139.82 NEW arsetg:GrwacIDOp3sT9fUP address=203.147.139.82,app=cpaneld,creator=arsetg,method=handle_form_login,path=loadsession:arsetg:ntcMn8aMMBZsUq39,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.6.168
country_id: 3932488
description:
179.6.6.168 - - [20/Jun/2026:07:04:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987435&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-211009hetidm21twh.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939094 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nwyj-211009hetidm21twh.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.6.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.252.144.23
country_id: 1210997
description:
138.252.144.23 - - [20/Jun/2026:07:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803724&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fun-pretre-demissionne-par-amour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939148 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/un-pretre-demissionne-par-amour/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.8094.1129 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.252.144.23


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:10:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:10:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.181.219
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:rgph-5-sandra-ablamba-johnson-preside-une-reunion-devaluation-detape/||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.248.213
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-11.107.174.248.213||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.3.246.10
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-12.192.3.246.10||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 192.3.246.10
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:milagroscathey9||Email:richardmartin5314mwmj@a.travel-e-store.com||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:14:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261606&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939687 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001818&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939711 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671787&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939687 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.181.201
country_id: 1861060
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:108.165.181.201||TA:108.165.181.201||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.120.12
country_id: 6252001
description:
[2026-06-20 07:19:24 +0000] info [cpaneld] 82.40.120.12 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:21:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:19557: 535 Incorrect authentication data (set_id=muszak)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-20 07:23:13 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.244
country_id: 2395170
description:
197.234.221.244 - - [20/Jun/2026:07:24:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327701&pdata=https%253A%252F%252Fdavakconsulting.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940245 HTTP/2.0" 302 0 davakconsulting.com "https://davakconsulting.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.234.221.244


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jun 20 07:26:21 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jun 20 07:26:27 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.43
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-28.148.222.185.43||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 07:28:44 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.203.44.26
country_id: 192950
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2018/01/Arr\xc3\xaat\xc3\xa9-MME-N\xc2\xb0007-AMPLI.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:28:46 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:12109: 535 Incorrect authentication data (set_id=adriel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:30:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235945&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940656 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:31:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790036&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940659 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:31:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393193&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940660 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.85
country_id: 3469034
description:
Jun 20 07:31:37 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.123.20
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1086477142 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.82.110
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202.webp 1600w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-1024x682.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-1536x1023.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.132
country_id: 1814991
description:
2026-06-20 07:34:22 dovecot_login authenticator failed for H=(132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:49194: 535 Incorrect authentication data (set_id=info@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.123.90.154
country_id: 3865483
description:
190.123.90.154 - - [20/Jun/2026:07:34:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119064&pdata=https%253A%252F%252Fwebmail.ns1.netmaster.tg%252F%253Flocale%253Dsv&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940862 HTTP/2.0" 302 0 webmail.ns1.netmaster.tg "https://webmail.ns1.netmaster.tg/?locale=sv" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.123.90.154


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 158.69.125.141
country_id: 6251999
domain: haplucia-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-20 07:34:24 +0000] info [cpaneld] 5.230.133.64 NEW wcnyaruu:fAcr1Oda4MIKarBD address=5.230.133.64,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.103.70.186
country_id: 1562822
description:
2026-06-20 07:35:05 dovecot_plain authenticator failed for H=(mduz3ogldeklj01g6cqlo9c7z0) [116.103.70.186]:36303: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:36:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:25426: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.88.55.186
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bca999 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:37:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:37:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.196
country_id: 690791
description:
Jun 20 07:42:04 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 07:43:08 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:43:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:57239: 535 Incorrect authentication data (set_id=cptest)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:43:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133464&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941431 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:44:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608854&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941453 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.2.178
country_id: 6252001
domain: soena.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/soena.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.105
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:premier-seminaire-gouvernemental-lexecutif-en-conclave-pour-definir-ses-orientations/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:44:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000022&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941435 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.129.94
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-45.191.102.129.94||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.25
country_id: 6252001
description:
205.169.39.25 - - [20/Jun/2026:07:47:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081706&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941638 HTTP/1.1" 302 0 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.25


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 07:47:26 +0000] info [cpaneld] 185.55.240.13 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.16
country_id: 2750405
description:
2026-06-20 07:50:07 dovecot_plain authenticator failed for H=(v8z710656hfok3a7j) [192.42.116.16]:45503: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 49.48.250.209
country_id: 1605651
description:
49.48.250.209 - - [20/Jun/2026:07:50:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6868118&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F13668&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941801 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/13668" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:49.48.250.209


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.2.50
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1680340185 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:50:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:17724: 535 Incorrect authentication data (set_id=jaimie)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:51:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:51:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.169.21.120
country_id: 3469034
description:
Jun 20 07:52:41 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.169.21.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.206.73
country_id: 690791
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?trk=organization_guest_main-feed-card-text HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.206.73
country_id: 690791
domain: www.arse.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tghttp/www.arse.tg/?trk=organization_guest_main-feed-card-text HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.45.123
country_id: 2542007
description:
2026-06-20 07:55:00 dovecot_plain authenticator failed for H=adsl196-123-45-206-196.adsl196-2.iam.net.ma (w0fuo6djy8rvt5p75x) [196.206.45.123]:53875: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.209
country_id: 953987
description:
Jun 20 07:55:48 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.39.11.242
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/03/neuf-nouveaux-ambassadeurs.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2021/03/neuf-nouveaux-ambassadeurs-300x201.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/03/neuf-nouveaux-ambassadeurs-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 07:57:20 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:58:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872302&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942287 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:58:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869469&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942306 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:58:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263396&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942287 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 07:57:33 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:57:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:26791: 535 Incorrect authentication data (set_id=kawano)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:58:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117827&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942311 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.226.34.19
country_id: 3017382
description:
[2026-06-20 08:01:04 +0000] info [cpaneld] 185.226.34.19 NEW conforwellty:JAOnYR3aYkM93j1y address=185.226.34.19,app=cpaneld,creator=conforwellty,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-20 08:01:22 +0000] info [cpaneld] 103.77.107.71 - @ "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.163.245.23
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/05/kkk-1.webp 945w, http:/togodailynews.tg/wp-content/uploads/2025/05/kkk-1-300x226.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/05/kkk-1-768x579.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 08:06:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:15284: 535 Incorrect authentication data (set_id=luke)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 08:06:20 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.156
country_id: 1880251
description:
43.173.178.156 - - [20/Jun/2026:08:07:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249882&pdata=https%253A%252F%252F24heureinfo.tg%252Fflash-info%252Fle-togo-bientot-connecte-au-starlink-delon-musk%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942833 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/flash-info/le-togo-bientot-connecte-au-starlink-delon-musk/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.156


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:07:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:07:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.191.73
country_id: 2245662
domain: www.togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.togodailynews.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.191.73
country_id: 2245662
domain: www.togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.togodailynews.tghttp/www.togodailynews.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.3.68.121
country_id: 1643084
description:
182.3.68.121 - - [20/Jun/2026:08:08:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661340&pdata=http%253A%252F%252Ftogodailynews.tg%252Ffocac2024-faure-gnassingbe-echange-avec-les-responsables-du-pcc&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942932 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/focac2024-faure-gnassingbe-echange-avec-les-responsables-du-pcc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.3.68.121


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.129.134
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-14.191.102.129.134||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:08:13:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12830821&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781943222 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 08:14:20 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:46240: 535 Incorrect authentication data (set_id=sikora)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:13:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014933&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781943219 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jun 20 08:16:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.103.54.253
country_id: 2921044
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47647.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97ce8c2502f46b4548cf6c337217e99bfa3c3382||Title:nmmv327apfwpecjr||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 86.103.54.253
country_id: 2921044
domain: arse.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.030951905303749694||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.57
country_id: 690791
description:
Jun 20 08:18:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.57 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:21:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:21:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 08:21:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 08:21:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:27594: 535 Incorrect authentication data (set_id=teodor)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.135
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-21.206.232.2.135||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.64.216
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8d8a84 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.13.143
country_id: 6252001
domain: atms.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/atms.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:28:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170463&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944088 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:08:28:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789531&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944091 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:08:29:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607624&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944196 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:30:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143902&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944199 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 20 08:30:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77277976
name: IM360 WAF: XMLRPC getUsersBlogs RBL infectors
abuser: 146.70.202.54
country_id: 6252001
domain: togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL infectors||Username:turboOMSA1494.togosem.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [20/Jun/2026:08:32:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7364971&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944375 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.66.28
country_id: 6252001
description:
[2026-06-20 08:33:15 +0000] info [cpaneld] 82.40.66.28 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.209.229.158
country_id: 597427
description:
[2026-06-20 08:33:53 +0000] info [cpaneld] 80.209.229.158 NEW wcnyaruu:O7jvuhmzloVFZ6r9 address=80.209.229.158,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.130.110
country_id: 2363686
description:
102.64.130.110 - - [20/Jun/2026:08:34:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6463341&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fsoja%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944455 HTTP/2.0" 302 0 direct7.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.6670.55 Safari/537.36 OPR/86.0.3852.88" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.130.110


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 102.64.130.110
country_id: 2363686
description:
102.64.130.110 - - [20/Jun/2026:08:34:56 +0000] "GET /tag/soja/ HTTP/2.0" 499 0 direct7.tg "https://direct7.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6463341&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fsoja%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944455" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.6670.55 Safari/537.36 OPR/86.0.3852.88" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.130.110


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:37:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.254.170.15
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/635455 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:36:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.42.198
country_id: 6252001
description:
[2026-06-20 08:37:32 +0000] info [cpaneld] 104.207.42.198 - waywcbyw "POST /execute/Variables/get_session_information HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.93.168.106
country_id: 783754
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/nouvelle-gamme-de-produits HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.226.149.64
country_id: 3932488
description:
38.226.149.64 - - [20/Jun/2026:08:41:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067374&pdata=https%253A%252F%252Feducplusmedia.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944859 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.226.149.64


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066536&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944906 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.141.33
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068-300x160.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068-1024x546.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068-768x410.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068.webp 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.135.166
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/acheter-sa-premiere-pharmacie-les-points-cles-2.webp 1000w, http:/togodailynews.tg/wp-content/uploads/2025/11/acheter-sa-premiere-pharmacie-les-points-cles-2-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/11/acheter-sa-premiere-pharmacie-les-points-cles-2-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:44:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656872&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945080 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:08:44:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259287&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945084 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.113.215.171
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060.webp 1040w, http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060-768x576.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:52:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:52:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-20 08:55:10 +0000] info [cpaneld] 5.230.153.156 NEW ttfuehop:LalFo8tsX3Q2tlwg address=5.230.153.156,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.85
country_id: 3469034
description:
Jun 20 08:55:20 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.176
country_id: 3175395
description:
Jun 20 08:55:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.194.89.150
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/05/Dr.-Ndiame-Diop-World-Bank-Country-Director-for-Nigeria.webp 900w, http:/togodailynews.tg/wp-content/uploads/2025/05/Dr.-Ndiame-Diop-World-Bank-Country-Director-for-Nigeria-300x165.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/05/Dr.-Ndiame-Diop-World-Bank-Country-Director-for-Nigeria-768x423.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:57:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050599&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945852 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:08:57:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118228&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945853 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.238
country_id: 226074
description:
Jun 20 08:59:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.238 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:59:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936232&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945984 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:00:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801509&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946003 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.248
country_id: 3469034
description:
Jun 20 09:02:51 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 09:04:22 +0000] info [cpaneld] 185.55.240.13 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.101.190.45
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006.jpg 869w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006-768x513.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.122.242.123
country_id: 3686110
description:
185.122.242.123 - - [20/Jun/2026:09:05:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001093&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Frecensement-dans-la-zone-2-les-crv-souvrent-de-7-a-17-heures-rappelle-la-ceni&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946324 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/recensement-dans-la-zone-2-les-crv-souvrent-de-7-a-17-heures-rappelle-la-ceni" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.122.242.123


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.119.135
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/11/t\xc3\xa9l\xc3\xa9chargement-27.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2021/11/t\xc3\xa9l\xc3\xa9chargement-27-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:09:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:09:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.119.173
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/jeu-concours-capsule-2023 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:11:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246487&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946714 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:11:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947497&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946716 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.11
country_id: 3865483
description:
Jun 20 09:12:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 09:13:04 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.154.42.198
country_id: 6252001
description:
[2026-06-20 09:13:08 +0000] info [cpaneld] 162.154.42.198 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.248.135
country_id: 6252001
description:
[2026-06-20 09:14:00 +0000] info [cpaneld] 76.35.248.135 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.87.197.113
country_id: 6252001
description:
[2026-06-20 09:13:41 +0000] info [cpaneld] 23.87.197.113 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.133.32.204
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-B.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-B-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-B-768x614.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:14:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055833&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946874 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:14:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739363&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946875 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.131.146.49
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit.jpg 1220w, http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit-300x205.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit-1024x699.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit-768x524.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.90
country_id: 3469034
description:
Jun 20 09:22:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.231.252.223
country_id: 285570
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/5c524b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.199.110.49
country_id: 1210997
description:
103.199.110.49 - - [20/Jun/2026:09:21:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922200&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fmodernisation-des-medias-au-togo-le-prof-prof-akodah-ayewouadan-receptionne-un-lot-de-materiel-dun-montant-de-62-millions-fcfa%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947302 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Fmodernisation-des-medias-au-togo-le-prof-prof-akodah-ayewouadan-receptionne-un-lot-de-materiel-dun-montant-de-62-millions-fcfa%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.199.110.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.191.25.99
country_id: 1562822
description:
14.191.25.99 - - [20/Jun/2026:09:22:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857171&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252F67-ans-au-service-de-lhumanite&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947369 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/67-ans-au-service-de-lhumanite" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.191.25.99


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.215.106
country_id: 3469034
description:
2026-06-20 09:23:18 dovecot_login authenticator failed for H=(45-181-215-106.brasnetinformatica.com.br.215.181.45.in-addr.arpa) [45.181.215.106]:52453: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:23:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-06-20 09:23:40 +0000] info [cpaneld] 134.195.82.68 NEW mbyqtkiw:lXahRqB6GxqFLo16 address=134.195.82.68,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:23:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.14.10
country_id: 226074
description:
Jun 20 09:27:22 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.14.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081034&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947666 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


