# incident

plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.16.157
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:167.253.16.157||TA:167.253.16.157||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 216.251.143.109
country_id: 6251999
description:
216.251.143.109 - - [28/Jun/2026:09:10:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069768&pdata=https%253A%252F%252Flepoint-actu.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782637846 HTTP/2.0" 302 0 lepoint-actu.tg "https://lepoint-actu.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.251.143.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 216.251.143.109
country_id: 6251999
description:
216.251.143.109 - - [28/Jun/2026:09:11:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185064&pdata=http%253A%252F%252Fmacite.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782637867 HTTP/1.1" 302 0 macite.tg "http://macite.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.251.143.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.15.185
country_id: 6252001
description:
[2026-06-28 09:11:22 +0000] info [cpaneld] 195.63.15.185 - dxsiclpd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.2.70
country_id: 6252001
description:
[2026-06-28 09:13:17 +0000] info [cpaneld] 195.63.2.70 - jmtctoni "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.41
country_id: 3469034
description:
Jun 28 09:14:24 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 28 09:14:29 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.99.160
country_id: 3865483
description:
Jun 28 09:15:43 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.99.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.99.160
country_id: 3865483
description:
Jun 28 09:15:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.99.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.185
country_id: 2635167
description:
[2026-06-28 09:17:53 +0000] info [cpaneld] 195.63.25.185 - moodlefreenetmas "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.184
country_id: 6251999
description:
[2026-06-28 09:20:22 +0000] info [cpaneld] 217.181.82.184 - vejjghdd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.86.144
country_id: 2017370
description:
2026-06-28 09:20:25 dovecot_plain authenticator failed for H=(pfhrv1o4nufgam1yquylw) [95.105.86.144]:32568: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.83.148
country_id: 6251999
description:
[2026-06-28 09:20:27 +0000] info [cpaneld] 217.181.83.148 - neliam "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.145
country_id: 2921044
description:
185.220.101.145 - nerohostfreenetm [28/Jun/2026:09:21:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317461&pdata=https%253A%252F%252Fnerohost.free.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782638501 HTTP/2.0" 302 0 nerohost.free.netmaster.tg "https://nerohost.free.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.145


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.128
country_id: 6251999
description:
[2026-06-28 09:23:21 +0000] info [cpaneld] 195.63.16.128 - pmalabvi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 28 09:24:06 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.78.48
country_id: 6252001
description:
[2026-06-28 09:24:43 +0000] info [cpaneld] 217.181.78.48 - pnls "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.73.64
country_id: 6252001
description:
[2026-06-28 09:25:17 +0000] info [cpaneld] 217.181.73.64 - qjzcsoob "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.76.160
country_id: 6252001
description:
[2026-06-28 09:25:21 +0000] info [cpaneld] 217.181.76.160 - sahamtg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.79.196
country_id: 6252001
description:
[2026-06-28 09:26:44 +0000] info [cpaneld] 217.181.79.196 - qfaclpeg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.69.23
country_id: 6252001
description:
[2026-06-28 09:27:40 +0000] info [cpaneld] 217.181.69.23 - sxoyfjqv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-06-28 09:27:45 dovecot_login authenticator failed for H=([183.171.12.224]) [182.60.128.241]:41056: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.75.61
country_id: 6252001
description:
[2026-06-28 09:27:01 +0000] info [cpaneld] 217.181.75.61 - bighostingsnbd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.72.83
country_id: 6252001
description:
[2026-06-28 09:27:35 +0000] info [cpaneld] 217.181.72.83 - pkyvzjjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.196
country_id: 2921044
description:
[2026-06-28 09:29:16 +0000] info [cpaneld] 217.181.85.196 - mipbtgnb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [28/Jun/2026:09:29:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933716&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782638986 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.20.203
country_id: 2921044
description:
[2026-06-28 09:29:41 +0000] info [cpaneld] 195.63.20.203 - doufelg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.102
country_id: 2921044
description:
[2026-06-28 09:29:49 +0000] info [cpaneld] 217.181.85.102 - waywcbyw "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.88
country_id: 2921044
description:
[2026-06-28 09:30:25 +0000] info [cpaneld] 195.63.21.88 - ulduzncs "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.140.247.160
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.140.247.160||TA:104.140.247.160||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.22
country_id: 2921044
description:
[2026-06-28 09:31:41 +0000] info [cpaneld] 195.63.21.22 - qledpnjw "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.105
country_id: 2921044
description:
[2026-06-28 09:31:11 +0000] info [cpaneld] 217.181.84.105 - wttzshhf "GET / HTTP/1.1" FAILED LOGIN cpaneld: User wttzshhf has their account suspended. Login blocked.


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 104.140.247.160
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r33309||MV:09-31.104.140.247.160||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.20.82
country_id: 2921044
description:
[2026-06-28 09:31:26 +0000] info [cpaneld] 195.63.20.82 - cipvzfnv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.19.64
country_id: 2921044
description:
[2026-06-28 09:32:20 +0000] info [cpaneld] 195.63.19.64 - aogodmm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.122
country_id: 2921044
description:
[2026-06-28 09:32:53 +0000] info [cpaneld] 217.181.84.122 - yydrdvav "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.19.58
country_id: 2921044
description:
[2026-06-28 09:32:22 +0000] info [cpaneld] 195.63.19.58 - vtytmwmz "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.20.131
country_id: 2921044
description:
[2026-06-28 09:32:26 +0000] info [cpaneld] 195.63.20.131 - xdkbrmjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.158.168.193
country_id: 2921044
domain: belali.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tg/wp-json/wp/v2/users HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.19.224
country_id: 2921044
description:
[2026-06-28 09:33:30 +0000] info [cpaneld] 195.63.19.224 - aopsacai "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.178
country_id: 1880251
description:
43.173.179.178 - - [28/Jun/2026:09:33:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7049575&pdata=https%253A%252F%252Fsoena.tg%252Fshop%252Fbouffe%252Fwingsn-shake%252Fpizza%252Forientale%252F%253Fshare%253Dtelegram&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782639188 HTTP/1.1" 404 561 soena.tg "https://soena.tg/shop/bouffe/wingsn-shake/pizza/orientale/?share=telegram" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.178


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.16.249
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.16.249: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.16.250
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.16.250: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.16.253
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.16.253: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 16.63.51.180
country_id: 2658434
domain: misstogo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/2?_fields=id,slug,roles||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.16.228
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.16.228: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.16.227
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.16.227: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.16.229
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.16.229: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.18.242
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 74.63.18.242: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.158.168.193
country_id: 2921044
domain: belali.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tg/wp-login.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.109.227
country_id: 226074
description:
2026-06-28 09:44:22 dovecot_plain authenticator failed for H=(localhost) [102.209.109.227]:27996: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.187.130.22
country_id: 2464461
description:
2026-06-28 09:45:02 dovecot_plain authenticator failed for H=(localhost) [196.187.130.22]:29943: 535 Incorrect authentication data (set_id=jean@zephyr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 28 09:46:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [28/Jun/2026:09:50:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921926&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782640245 HTTP/1.1" 302 0 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.152
country_id: 798544
description:
Jun 28 09:50:40 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.191
country_id: 3469034
description:
Jun 28 09:51:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.191 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.13.220
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.13.220||TA:152.232.13.220||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 102.64.164.200
country_id: 2363686
description:
[2026-06-28 09:55:06 +0000] info [whostmgrd] 102.64.164.200 NEW root:aGoatez_HkNPeE5Q address=102.64.164.200,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.213.127
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.28.213.127||TA:104.28.213.127||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.219.135
country_id: 2395170
description:
Jun 28 09:57:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.219.135 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [28/Jun/2026:09:56:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987628&pdata=http%253A%252F%252F1l7yem.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782640609 HTTP/1.1" 302 0 1l7yem.mediatopnews.tg "http://1l7yem.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.121.145.59
country_id: 6252001
description:
[2026-06-28 09:58:35 +0000] info [whostmgrd] 71.121.145.59 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.73
country_id: 3469034
description:
Jun 28 09:59:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.16.197.252
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/2073165185 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-28 10:05:25 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54508: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:06:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4506: 535 Incorrect authentication data (set_id=saiyou@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:06:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31604: 535 Incorrect authentication data (set_id=fatturazione@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:06:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18842: 535 Incorrect authentication data (set_id=bene@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:06:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.147.229.108
country_id: 6252001
description:
[2026-06-28 10:07:27 +0000] info [whostmgrd] 24.147.229.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:07:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64768: 535 Incorrect authentication data (set_id=fatturazione@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:07:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15300: 535 Incorrect authentication data (set_id=tetris@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:08:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47524: 535 Incorrect authentication data (set_id=ambiance@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:08:11 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:07:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11100: 535 Incorrect authentication data (set_id=ghenry@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:09:19 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:08:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23308: 535 Incorrect authentication data (set_id=dapa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:09:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:10:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51532: 535 Incorrect authentication data (set_id=elisa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:10:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:10:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:10:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7524: 535 Incorrect authentication data (set_id=elisa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:10:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39434: 535 Incorrect authentication data (set_id=xbox@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:11:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14904: 535 Incorrect authentication data (set_id=monitoring@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:11:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:11:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53710: 535 Incorrect authentication data (set_id=images4@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:11:10 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:12:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23660: 535 Incorrect authentication data (set_id=desk@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:12:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:12:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:6604: 535 Incorrect authentication data (set_id=kmem@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:11:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29620: 535 Incorrect authentication data (set_id=adx@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:12:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:13:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:13:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19576: 535 Incorrect authentication data (set_id=charles@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:13:21 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:13:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:6480: 535 Incorrect authentication data (set_id=redes@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.240
country_id: 1880251
description:
43.173.176.240 - - [28/Jun/2026:10:13:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182487&pdata=http%253A%252F%252Fmacite.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782641615 HTTP/1.1" 404 561 macite.tg "http://macite.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.240


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:14:04 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:13:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:14:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46648: 535 Incorrect authentication data (set_id=openid@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.19.60.119
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/439175105 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:13:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15984: 535 Incorrect authentication data (set_id=netc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:14:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:15:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62168: 535 Incorrect authentication data (set_id=zabbix@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:15:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:15:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:62604: 535 Incorrect authentication data (set_id=mapa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:16:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38290: 535 Incorrect authentication data (set_id=patricia@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:16:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8276: 535 Incorrect authentication data (set_id=ssladmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:15:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:16:07 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:16:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52282: 535 Incorrect authentication data (set_id=ssladmin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:17:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28160: 535 Incorrect authentication data (set_id=monteurs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:17:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13898: 535 Incorrect authentication data (set_id=johnson-family@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.163.16.232
country_id: 6252001
description:
152.163.16.232 - - [28/Jun/2026:10:17:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6605717&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F02%252F12%252Fpresidentielles-2020-connaitre-son-bureau-de-vote-par-un-sms-gratuit%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782641818 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/02/12/presidentielles-2020-connaitre-son-bureau-de-vote-par-un-sms-gratuit/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.7412.1686 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.163.16.232


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:16:58 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:17:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:18:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:18:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30258: 535 Incorrect authentication data (set_id=robert1@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.203
country_id: 1880251
description:
43.172.195.203 - - [28/Jun/2026:10:18:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313814&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Feconomie%25252Fquest-ce-que-la-cooperation-sud-sud-et-pourquoi-est-ce-important%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782641881 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Feconomie%2Fquest-ce-que-la-cooperation-sud-sud-et-pourquoi-est-ce-important%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:18:22 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:17:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22740: 535 Incorrect authentication data (set_id=monitor1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:19:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:19:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5472: 535 Incorrect authentication data (set_id=allen@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:19:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:19:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20536: 535 Incorrect authentication data (set_id=juliet@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:19:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:45728: 535 Incorrect authentication data (set_id=eugene@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:19:59 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:20:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61044: 535 Incorrect authentication data (set_id=cp-ht-11@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:20:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14376: 535 Incorrect authentication data (set_id=eugene@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:20:05 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:21:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61706: 535 Incorrect authentication data (set_id=soutien@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 10:21:37 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:21:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63224: 535 Incorrect authentication data (set_id=hanson@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:21:18 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:21:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39128: 535 Incorrect authentication data (set_id="carla"@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:22:02 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:22:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37246: 535 Incorrect authentication data (set_id=aston@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:22:16 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:22:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:23:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53344: 535 Incorrect authentication data (set_id=nuage@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:22:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46232: 535 Incorrect authentication data (set_id=nuage@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:23:03 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:23:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49674: 535 Incorrect authentication data (set_id=ash@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:23:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25502: 535 Incorrect authentication data (set_id=marcia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:24:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28756: 535 Incorrect authentication data (set_id=scanner2@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.4.133.93
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/8c7b75 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:24:11 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:23:55 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:25:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37576: 535 Incorrect authentication data (set_id=uruguay@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:25:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:25:17 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:25:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21202: 535 Incorrect authentication data (set_id=link_text@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 28 10:25:32 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:25:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20474: 535 Incorrect authentication data (set_id=edm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:26:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61596: 535 Incorrect authentication data (set_id=qwertyuiop@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:26:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17610: 535 Incorrect authentication data (set_id=qwertyuiop@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:25:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:26:02 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:26:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58040: 535 Incorrect authentication data (set_id=bijans@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:27:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60660: 535 Incorrect authentication data (set_id=choa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:26:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:27:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39534: 535 Incorrect authentication data (set_id=cera@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:28:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5024: 535 Incorrect authentication data (set_id=ababa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:28:19 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:28:34 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 28 10:28:57 ns5.netmaster.tg cpanel_fileman_hook[405425]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user dvhzmira


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:29:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50182: 535 Incorrect authentication data (set_id=elias@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:29:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52224: 535 Incorrect authentication data (set_id=ats@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:29:21 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:29:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20900: 535 Incorrect authentication data (set_id=ats@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:29:09 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:29:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:29:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27914: 535 Incorrect authentication data (set_id=payments@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:30:01 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:30:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26180: 535 Incorrect authentication data (set_id=andrei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 28 10:30:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-28 10:30:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36576: 535 Incorrect authentication data (set_id=hsc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-28 10:31:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7720: 535 Incorrect authentication data (set_id=1a2b3c4d@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.85.161.9
country_id: 6252001
description:
[2026-06-28 10:31:25 +0000] info [whostmgrd] 97.85.161.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 28 10:31:00 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.19.3.90
country_id: 6252001
description:
[2026-06-28 10:31:33 +0000] info [whostmgrd] 70.19.3.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.192
country_id: 1880251
description:
43.172.197.192 - - [28/Jun/2026:10:32:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712006&pdata=https%253A%252F%252Fsoena.tg%252Fshop%252Fbouffe%252Fpizzavi%252Fboissons%252Fcafe%252F%253Fadd_to_wishlist%253D2001&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782642719 HTTP/1.1" 404 561 soena.tg "https://soena.tg/shop/bouffe/pizzavi/boissons/cafe/?add_to_wishlist=2001" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.192


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.230.18.40
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1959572718 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.109.31
country_id: 1880251
domain: auditeccandco.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 10:38:30 +0000] info [cpaneld] 188.166.248.160 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [28/Jun/2026:10:43:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383514&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782643380 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.17.110.168
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sante-publique-une-annee-de-consolidation-et-de-progres-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.17.110.168
country_id: 3437598
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/sante-publique-une-annee-de-consolidation-et-de-progres-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.20
country_id: 298795
description:
Jun 28 10:45:54 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.20.112.184
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-une-nouvelle-etape-pour-laccompagnement-entrepreneurial-des-jeunes/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.20.112.184
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-une-nouvelle-etape-pour-laccompagnement-entrepreneurial-des-jeunes/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 11:00:38 +0000] info [cpaneld] 188.166.248.160 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 24.144.77.78
country_id: 2750405
description:
24.144.77.78 - - [28/Jun/2026:11:00:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670485&pdata=https%253A%252F%252Fappflutter.free.netmaster.tg%252Fbee&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782644438 HTTP/2.0" 302 0 appflutter.free.netmaster.tg "https://appflutter.free.netmaster.tg/bee" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:24.144.77.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.169.229
country_id: 149590
description:
Jun 28 11:03:42 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.78.169.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 11:03:14 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.169.229
country_id: 149590
description:
Jun 28 11:03:56 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.78.169.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.119
country_id: 3865483
description:
Jun 28 11:04:12 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 11:05:35 +0000] info [cpaneld] 188.166.248.160 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.44.216.25
country_id: 6252001
description:
[2026-06-28 11:05:04 +0000] info [whostmgrd] 24.44.216.25 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
country_id: 2017370
description:
Jun 28 11:06:57 ns5 auth[58168]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2026-06-28 11:06:59 dovecot_login authenticator failed for H=([24.45.137.84]) [88.84.209.146]:49980: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.32.187.189
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1267827455 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 109.166.202.229
country_id: 798549
description:
Denial of Service (DoS) attack was discovered from 109.166.202.229: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 109.166.202.219
country_id: 798549
description:
Denial of Service (DoS) attack was discovered from 109.166.202.219: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [28/Jun/2026:11:11:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068392&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782645074 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-06-28 11:11:47 dovecot_login authenticator failed for H=([218.81.180.21]) [74.208.177.56]:45040: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-06-28 11:12:24 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [13.68.214.34]:48852: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-06-28 11:16:49 dovecot_login authenticator failed for H=([174.75.211.195]) [211.53.58.10]:51049: 535 Incorrect authentication data (set_id=fate@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-06-28 11:17:51 dovecot_login authenticator failed for H=([98.181.137.75]) [196.188.187.205]:36538: 535 Incorrect authentication data (set_id=gudef_togo@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.250.67.190
country_id: 1835841
description:
Jun 28 11:18:02 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.250.67.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-06-28 11:18:04 dovecot_login authenticator failed for H=([59.126.19.64]) [1.250.67.190]:48188: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.30.11.253
country_id: 6252001
description:
Jun 28 11:18:06 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.30.11.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-06-28 11:18:08 dovecot_plain authenticator failed for H=(apshmay) [23.30.11.253]:38233: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-06-28 11:18:23 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([36.135.62.94]) [220.246.47.146]:51554: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.84
country_id: 1880251
description:
43.172.195.84 - - [28/Jun/2026:11:18:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235993&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Ftogo-aime-gogue-condamne-les-manoeuvres-visant-larrestation-dagbeyome-kodjo%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782645508 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Ftogo-aime-gogue-condamne-les-manoeuvres-visant-larrestation-dagbeyome-kodjo%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.84


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.47.146
country_id: 1819730
description:
Jun 28 11:18:21 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.47.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.83.111.213
country_id: 6252001
description:
[2026-06-28 11:22:52 +0000] info [whostmgrd] 68.83.111.213 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-06-28 11:23:09 dovecot_login authenticator failed for H=([69.115.178.196]) [182.95.229.110]:55378: 535 Incorrect authentication data (set_id=office@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.229.110
country_id: 1269750
description:
Jun 28 11:23:07 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.229.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-06-28 11:27:20 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([111.26.106.115]) [83.255.209.245]:59798: 535 Incorrect authentication data (set_id=dtabo@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.209.245
country_id: 2661886
description:
Jun 28 11:27:18 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.209.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.247.238.249
country_id: 3469034
description:
170.247.238.249 - - [28/Jun/2026:11:29:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591896&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-publication-des-photos-attentatoires-a-la-dignite-un-acte-puni-par-le-code-penal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782646145 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-publication-des-photos-attentatoires-a-la-dignite-un-acte-puni-par-le-code-penal/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.3324.1431 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.247.238.249


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.242
country_id: 1880251
description:
43.173.179.242 - - [28/Jun/2026:11:29:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065776&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Falcootest%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782646192 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/alcootest/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.219.101.246
country_id: 798544
description:
2026-06-28 11:40:21 dovecot_login authenticator failed for H=(178.219.101.246) [178.219.101.246]:57721: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.61.165
country_id: 895949
description:
Jun 28 11:41:35 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.61.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.61.165
country_id: 895949
description:
2026-06-28 11:41:37 dovecot_login authenticator failed for H=([24.45.137.84]) [41.63.61.165]:2048: 535 Incorrect authentication data (set_id=office@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 11:44:38 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.212.213.91
country_id: 2017370
domain: pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:155.212.213.91||TA:155.212.213.91||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-28 11:46:56 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-28 11:46:55 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.188.171.59
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1321443750 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-06-28 11:54:21 dovecot_login authenticator failed for H=([222.76.248.54]) [59.25.212.83]:38662: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.204.214.146
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/689367453 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.89.146
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.163.89.146||TA:193.163.89.146||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.76
country_id: 298795
description:
Jun 28 11:55:47 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-06-28 12:00:42 dovecot_login authenticator failed for H=([175.200.217.128]) [220.72.198.61]:44410: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.42.81.25
country_id: 6252001
description:
[2026-06-28 12:00:53 +0000] info [cpaneld] 38.42.81.25 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.161.6.36
country_id: 6252001
description:
[2026-06-28 12:01:00 +0000] info [cpaneld] 70.161.6.36 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.30.147.182
country_id: 6252001
description:
[2026-06-28 12:01:03 +0000] info [cpaneld] 216.30.147.182 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.45.96.132
country_id: 6252001
description:
[2026-06-28 12:01:06 +0000] info [cpaneld] 24.45.96.132 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.249.138.113
country_id: 6252001
description:
[2026-06-28 12:01:11 +0000] info [cpaneld] 172.249.138.113 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.115.17.147
country_id: 6252001
description:
[2026-06-28 12:00:57 +0000] info [cpaneld] 71.115.17.147 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.128.36.166
country_id: 6252001
description:
[2026-06-28 12:01:14 +0000] info [cpaneld] 73.128.36.166 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.109.22.167
country_id: 6252001
description:
[2026-06-28 12:01:18 +0000] info [cpaneld] 74.109.22.167 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.41.120
country_id: 6252001
description:
[2026-06-28 12:01:21 +0000] info [cpaneld] 76.90.41.120 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.51.92
country_id: 3469034
description:
Jun 28 12:01:24 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.51.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.51.92
country_id: 3469034
description:
2026-06-28 12:01:26 dovecot_login authenticator failed for H=([184.185.2.254]) [131.108.51.92]:55970: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-06-28 12:02:18 dovecot_login authenticator failed for H=([122.185.68.89]) [59.145.160.134]:60772: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.46.59
country_id: 1733045
description:
180.75.46.59 - - [28/Jun/2026:12:02:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066537&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-351820citems%252Fetidm.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782648151 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-351820citems/etidm.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.46.59


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 82.157.99.159
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/decentralisation-en-afrique-postulez-pour-le-prix-dexcellence-du-leadership-local-2026/<script async src=||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.3.222.224
country_id: 1643084
description:
[2026-06-28 12:04:02 +0000] info [cpaneld] 103.3.222.224 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.163.109.143
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1066019992 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.227.5
country_id: 294640
description:
[2026-06-28 12:06:39 +0000] info [cpaneld] 169.150.227.5 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.227.5
country_id: 294640
description:
[2026-06-28 12:08:42 +0000] info [cpaneld] 169.150.227.5 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.49.128
country_id: 783754
description:
[2026-06-28 12:10:08 +0000] info [whostmgrd] 94.100.49.128 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.96.46
country_id: 2363686
description:
[2026-06-28 12:10:30 +0000] info [cpaneld] 196.168.96.46 NEW ingertgsarl:wKuFkUnL0xmwgmLb address=196.168.96.46,app=cpaneld,creator=ingertgsarl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.227.5
country_id: 294640
description:
[2026-06-28 12:10:25 +0000] info [cpaneld] 169.150.227.5 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 122.8.44.180
country_id: 1814991
description:
122.8.44.180 - - [28/Jun/2026:12:12:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212830&pdata=http%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782648721 HTTP/1.1" 302 0 dany2.mairie.tg "http://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:122.8.44.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.227.232
country_id: 3469034
description:
Jun 28 12:12:54 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.227.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [06/28/2026:12:13:52 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.227.232
country_id: 3469034
description:
Jun 28 12:13:00 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.227.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.49.128
country_id: 783754
description:
[2026-06-28 12:14:09 +0000] info [whostmgrd] 94.100.49.128 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.121
country_id: 1880251
description:
47.128.121.121 - - [28/Jun/2026:12:14:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988712&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fjeu-promo-conso%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782648869 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/jeu-promo-conso/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.169
country_id: 1880251
description:
47.128.120.169 - - [28/Jun/2026:12:14:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935207&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fviens-tasseoir-et-tiens-faure%252Flibertinage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782648868 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/viens-tasseoir-et-tiens-faure/libertinage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.169


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 12:18:10 +0000] info [cpaneld] 188.166.248.160 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.162
country_id: 337996
description:
2026-06-28 12:23:47 dovecot_login authenticator failed for H=([188.122.39.33]) [196.190.43.162]:51508: 535 Incorrect authentication data (set_id=office@anrtogo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.92
country_id: 1880251
description:
43.173.176.92 - - [28/Jun/2026:12:25:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184298&pdata=http%253A%252F%252Fcafe.tg%252Fcat%252Factualites%252Fpage%252F23%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782649520 HTTP/1.1" 404 561 cafe.tg "http://cafe.tg/cat/actualites/page/23/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.92


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.10
country_id: 6252001
description:
Jun 28 12:26:28 ns5 pure-ftpd[458811]: (?@207.90.244.10) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 12:30:00 +0000] info [cpaneld] 188.166.248.160 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.179.238
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/opera/salade/?add-to-cart=3553||QS:add-to-cart=3553||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 12:32:26 +0000] info [cpaneld] 188.166.248.160 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.63.138.73
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/08-mars-5000-femmes-togolaises-retrouvent-une-identite-civile/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.63.138.73
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/08-mars-5000-femmes-togolaises-retrouvent-une-identite-civile/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.173.243
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/wingsn-shake/nos-volailles/brochette-de-blanc-de-poulet/?add-to-cart=1929||QS:add-to-cart=1929||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.242.216.25
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/803885681 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.34.131.119
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-rappeur-gims-place-en-garde-a-vue-pour-blanchiment/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 12:38:33 +0000] info [cpaneld] 188.166.248.160 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 164.152.167.229
country_id: 1880251
description:
Jun 28 12:41:23 ns5 pure-ftpd[467019]: (?@164.152.167.229) [WARNING] Authentication failed for user [stephane@sitewebofficiel.tg]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.152.167.229
country_id: 1880251
description:
Jun 28 12:41:19 ns5 pure-ftpd[467017]: (?@164.152.167.229) [INFO] New connection from 164.152.167.229


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 82.117.243.149
country_id: 2750405
domain: www.shekina.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:82.117.243.149||TA:82.117.243.149||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.223.32.225
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.223.32.225||TA:104.223.32.225||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.160.29
country_id: 6252001
description:
[2026-06-28 12:44:51 +0000] info [cpaneld] 73.23.160.29 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.97.225.12
country_id: 6252001
description:
[2026-06-28 12:44:46 +0000] info [cpaneld] 75.97.225.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.202.73
country_id: 6252001
description:
[2026-06-28 12:45:07 +0000] info [cpaneld] 96.241.202.73 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.31.241.36
country_id: 6252001
description:
[2026-06-28 12:45:00 +0000] info [cpaneld] 66.31.241.36 - bela "GET /login/?login_only=1&user=bela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.140.9.32
country_id: 6252001
description:
[2026-06-28 12:45:04 +0000] info [cpaneld] 24.140.9.32 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.143.23.141
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/976480842 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.180.7.125
country_id: 130758
description:
2026-06-28 12:48:02 dovecot_plain authenticator failed for H=(bpc6bjmj7p9vt53icqesks0) [2.180.7.125]:38231: 535 Incorrect authentication data (set_id=deroupartners@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.159.103
country_id: 690791
description:
Jun 28 12:51:13 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.159.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.38.68.144
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2079204118 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.232.94
country_id: 6252001
description:
[2026-06-28 12:52:16 +0000] info [cpaneld] 73.111.232.94 - camegtogotg "GET /login/?login_only=1&user=camegtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.63.24.45
country_id: 6252001
description:
[2026-06-28 12:52:41 +0000] info [cpaneld] 71.63.24.45 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.190.75.154
country_id: 6252001
description:
[2026-06-28 12:52:23 +0000] info [cpaneld] 24.190.75.154 - camegto "GET /login/?login_only=1&user=camegto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.161.84
country_id: 6252001
description:
[2026-06-28 12:52:35 +0000] info [cpaneld] 174.63.161.84 - came "GET /login/?login_only=1&user=came&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user came (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.208.216
country_id: 6252001
description:
[2026-06-28 12:52:10 +0000] info [cpaneld] 76.36.208.216 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.221.141.175
country_id: 6252001
description:
[2026-06-28 12:52:13 +0000] info [cpaneld] 47.221.141.175 - camegtogo "GET /login/?login_only=1&user=camegtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 28 12:52:16 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.35.54.95
country_id: 6252001
description:
[2026-06-28 12:52:20 +0000] info [cpaneld] 68.35.54.95 - camegtog "GET /login/?login_only=1&user=camegtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.65.82
country_id: 6252001
description:
[2026-06-28 12:52:31 +0000] info [cpaneld] 96.241.65.82 - cameg "GET /login/?login_only=1&user=cameg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cameg (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.219
country_id: 290557
description:
2026-06-28 12:53:36 H=([217.60.195.219]) [217.60.195.219]:55328 F=<noreply@formlinksystems.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.152.105.243
country_id: 1861060
domain: digilix.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:ohuuvcqw||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [28/Jun/2026:12:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868643&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651339 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.152.105.243
country_id: 1861060
domain: digilix.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:ohuuvcqw||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.161.50.108
country_id: 2017370
description:
46.161.50.108 - - [28/Jun/2026:12:55:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038051&pdata=https%253A%252F%252Fwww.togosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651353 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.161.50.108


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 5.101.64.6
country_id: 2017370
description:
5.101.64.6 - - [28/Jun/2026:12:56:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725339&pdata=https%253A%252F%252Fwww.togosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651361 HTTP/2.0" 404 561 www.togosem.com "https://www.togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.101.64.6


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 5.101.64.6
country_id: 2017370
description:
5.101.64.6 - - [28/Jun/2026:12:56:03 +0000] "GET /favicon.ico HTTP/2.0" 415 587 www.togosem.com "https://www.togosem.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725339&pdata=https%253A%252F%252Fwww.togosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651361" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.101.64.6


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-28 12:56:47 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53956: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.31.89.217
country_id: 1269750
description:
47.31.89.217 - - [28/Jun/2026:12:56:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078826&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-306715hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651361 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-306715hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.31.89.217


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.217
country_id: 3865483
description:
Jun 28 12:56:14 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.26.22
country_id: 933860
description:
Jun 28 12:56:44 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.26.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [28/Jun/2026:12:56:09 +0000] "GET /favicon.ico HTTP/1.1" 302 31 www.togosem.com "https://www.togosem.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725339&pdata=https%253A%252F%252Fwww.togosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651361" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.8.182.229
country_id: 1643084
description:
182.8.182.229 - - [28/Jun/2026:12:57:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118791&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F28%252Fdialogue-strategique-togo-europe-transformer-les-investissements-en-moteur-de-croissance%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651435 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/28/dialogue-strategique-togo-europe-transformer-les-investissements-en-moteur-de-croissance/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.9262.1970 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.8.182.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.231.175.180
country_id: 3469034
description:
2026-06-28 12:57:22 dovecot_plain authenticator failed for H=([69.172.210.47]) [170.231.175.180]:29376: 535 Incorrect authentication data (set_id=info@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-28 12:56:57 +0000] info [cpaneld] 64.111.92.123 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.207.36.138
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.207.36.138||TA:104.207.36.138||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.43.8.145
country_id: 3469034
description:
2026-06-28 12:58:01 dovecot_plain authenticator failed for H=([69.172.210.47]) [179.43.8.145]:48030: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.17.176.41
country_id: 6252001
description:
[2026-06-28 12:59:08 +0000] info [cpaneld] 174.17.176.41 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.4.240.216
country_id: 6252001
description:
[2026-06-28 12:59:23 +0000] info [cpaneld] 68.4.240.216 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.220.253.8
country_id: 6252001
description:
[2026-06-28 12:59:38 +0000] info [cpaneld] 97.220.253.8 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.83.204.109
country_id: 6252001
description:
[2026-06-28 12:59:13 +0000] info [cpaneld] 162.83.204.109 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.130.55.116
country_id: 6252001
description:
[2026-06-28 12:59:20 +0000] info [cpaneld] 74.130.55.116 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.30.230.37
country_id: 6252001
description:
[2026-06-28 12:59:31 +0000] info [cpaneld] 66.30.230.37 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.39.53
country_id: 6252001
description:
[2026-06-28 13:02:29 +0000] info [cpaneld] 98.97.39.53 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.114.69.206
country_id: 6252001
description:
[2026-06-28 13:02:20 +0000] info [cpaneld] 69.114.69.206 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.250.83.23
country_id: 1269750
description:
103.250.83.23 - - [28/Jun/2026:13:02:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000273&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Fcndh%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782651724 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/cndh/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.4839.1005 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.250.83.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.251.249.60
country_id: 6252001
description:
[2026-06-28 13:02:08 +0000] info [cpaneld] 104.251.249.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.186.55.97
country_id: 6252001
description:
[2026-06-28 13:02:16 +0000] info [cpaneld] 98.186.55.97 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.241.138.195
country_id: 6252001
description:
[2026-06-28 13:02:33 +0000] info [cpaneld] 72.241.138.195 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.0.222.243
country_id: 6252001
description:
[2026-06-28 13:02:40 +0000] info [cpaneld] 24.0.222.243 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.119.227
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.119.227: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.253.66.137
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/808954739 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.119.230
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.119.230: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.56.7.120
country_id: 1269750
description:
2026-06-28 13:04:50 dovecot_plain authenticator failed for H=(localhost) [152.56.7.120]:47393: 535 Incorrect authentication data (set_id=sonia.lassey@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 28 13:05:57 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.1.34.242
country_id: 719819
description:
Jun 28 13:06:04 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.1.34.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.228.77.28
country_id: 3469034
domain: www.construction.sia-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:qfaclpeg||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 13:07:27 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 28 13:08:23 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.30.129.165
country_id: 6251999
description:
Jun 28 13:09:15 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.30.129.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-06-28 13:09:17 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca (ipmapt-72-195-34-45.oc.oc.cox.net) [96.30.129.165]:59113: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 50.18.135.181
country_id: 6252001
domain: www.boutique.cafe.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:cafetg||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 50.18.135.181
country_id: 6252001
domain: www.boutique.cafe.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/info.php.bak||User:cafetg||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 78.51.22.206
country_id: 2921044
description:
78.51.22.206 - - [28/Jun/2026:13:11:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985574&pdata=https%253A%252F%252Fcfpj.tg%252Fhdvc-20776qitems%252Fetidm82ch.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782652260 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/hdvc-20776qitems/etidm82ch.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.51.22.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-06-28 13:13:37 dovecot_login authenticator failed for H=(213-66-196-11-no2550.tbcn.telia.com) [125.19.206.54]:47192: 535 Incorrect authentication data (set_id=contact@cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.19.179
country_id: 2921044
description:
[2026-06-28 13:14:15 +0000] info [cpaneld] 195.63.19.179 - cietg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.223
country_id: 2921044
description:
[2026-06-28 13:14:27 +0000] info [cpaneld] 217.181.84.223 - cietg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.203.225.242
country_id: 337996
description:
2026-06-28 13:18:12 dovecot_plain authenticator failed for H=(localhost) [102.203.225.242]:11779: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 156.203.253.114
country_id: 357994
description:
Denial of Service (DoS) attack was discovered from 156.203.253.114: 80 connections per 30 seconds to 2087 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.17
country_id: 1880251
description:
43.173.179.17 - - [28/Jun/2026:13:23:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842265&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Fdeux-cadres-togolais-en-stage-en-egypte%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782652997 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/diplomatie/deux-cadres-togolais-en-stage-en-egypte/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.17


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.177.150
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product/riz-pizzavi/?add-to-cart=3645||QS:add-to-cart=3645||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.57.95.72
country_id: 2275384
description:
2026-06-28 13:26:11 dovecot_plain authenticator failed for H=(localhost) [41.57.95.72]:61874: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.244.117.168
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-27.207.244.117.168||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 207.244.117.168
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:207.244.117.168||TA:207.244.117.168||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.200.191.248
country_id: 1269750
description:
[2026-06-28 13:28:24 +0000] info [whostmgrd] 35.200.191.248 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 35.200.191.248
country_id: 1269750
description:
[2026-06-28 13:28:27 +0000] info [whostmgrd] 35.200.191.248 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.199.147.233
country_id: 6252001
description:
[2026-06-28 13:29:26 +0000] info [cpaneld] 71.199.147.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.16.133.153
country_id: 6252001
description:
[2026-06-28 13:29:36 +0000] info [cpaneld] 174.16.133.153 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.235.136.133
country_id: 6252001
description:
[2026-06-28 13:29:32 +0000] info [cpaneld] 97.235.136.133 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.171.218.234
country_id: 6252001
description:
[2026-06-28 13:29:45 +0000] info [cpaneld] 173.171.218.234 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.23.176.148
country_id: 6252001
description:
[2026-06-28 13:29:51 +0000] info [cpaneld] 76.23.176.148 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.135.101.247
country_id: 1819730
description:
43.135.101.247 - - [28/Jun/2026:13:31:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936132&pdata=http%253A%252F%252Ftogodailynews.tg%252Fle-chef-de-letat-a-echange-avec-des-responsables-des-institutions-parlementaires-du-liberia-du-niger-de-la-guinee-et-du-mali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782653464 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.135.101.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-28 13:33:51 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44308: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.3.130
country_id: 241170
domain: afriquerevelation.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-37.31.134.3.130||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.221.177.191
country_id: 6252001
description:
[2026-06-28 13:38:38 +0000] info [cpaneld] 18.221.177.191 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 18.221.177.191
country_id: 6252001
description:
18.221.177.191 - - [28/Jun/2026:13:38:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725544&pdata=https%253A%252F%252Finger.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782653911 HTTP/2.0" 302 0 inger.tg "https://inger.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:18.221.177.191


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.160.72
country_id: 6252001
description:
2026-06-28 13:44:16 dovecot_plain authenticator failed for H=(smtp.arse.tg) [104.28.160.72]:18665: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.63.71.74
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 182.63.71.74: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.63.7.74
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 182.63.7.74: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 186.65.113.254
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:186.65.113.254||TA:186.65.113.254||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.192
country_id: 690791
description:
Jun 28 13:46:52 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.192 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 142.93.101.131
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 142.93.101.131: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.203
country_id: 2921044
description:
[2026-06-28 13:47:13 +0000] info [cpaneld] 195.63.21.203 - vuvwskxh "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.192
country_id: 690791
description:
Jun 28 13:46:59 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 13:48:51 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.215.145.252
country_id: 1269750
description:
Jun 28 13:49:11 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.215.145.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.215.145.252
country_id: 1269750
description:
2026-06-28 13:49:13 dovecot_plain authenticator failed for H=(localhost) [106.215.145.252]:8688: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.58.13.72
country_id: 3175395
description:
2.58.13.72 - - [28/Jun/2026:13:52:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7510127&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Felection-regionale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782654747 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/election-regionale/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.6263.1145 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.58.13.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.64.250.172
country_id: 690791
description:
Jun 28 13:53:56 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.64.250.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.82
country_id: 6252001
description:
[2026-06-28 13:55:13 +0000] info [cpaneld] 195.63.9.82 - vejjghdd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 152.52.166.26
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 152.52.166.26: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.95.227.107
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 61.95.227.107: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.71.154.38
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/visite-du-ministre-allemand-de-la-cooperation-economique-et-du-developpement HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.243.174.141
country_id: 798544
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:151.243.174.141||TA:151.243.174.141||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 59.103.104.34
country_id: 1168579
domain: sproca.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34825.sproca.tg||ServerName:sproca.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:963cd028a4f15efc036bf84b07a8ea661552eff7||Title:0x24d0ecac||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.114.209
country_id: 3175395
description:
Jun 28 14:08:58 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.114.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.235.36.170
country_id: 1562822
description:
2026-06-28 14:11:40 dovecot_plain authenticator failed for H=(localhost) [14.235.36.170]:50880: 535 Incorrect authentication data (set_id=sonia.lassey@mesyscom.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.16.184
country_id: 1880251
domain: mail.zephyr.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/images/index.php||SC:/home/zephyradmin/public_html/images||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.0.37
country_id: 1880251
description:
43.163.0.37 - - [28/Jun/2026:14:13:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196121&pdata=https%253A%252F%252Fruralinfos.tg%252Fproduction%252Felevage%252Ftranshumance-mieux-informer-les-acteurs-pour-eviter-les-conflits%252F%253Fshare%253Djetpack-whatsapp&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782655983 HTTP/2.0" 302 0 ruralinfos.tg "https://ruralinfos.tg/production/elevage/transhumance-mieux-informer-les-acteurs-pour-eviter-les-conflits/?share=jetpack-whatsapp" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.0.37


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.242.7
country_id: 1562822
description:
2026-06-28 14:13:56 dovecot_plain authenticator failed for H=(localhost) [117.4.242.7]:62861: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.195.108.155
country_id: 2921044
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:154.195.108.155||TA:154.195.108.155||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.85
country_id: 933860
description:
Jun 28 14:16:06 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 28 14:19:27 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.255.76
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.255.76: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.254.197
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.254.197: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 28 14:19:17 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.222
country_id: 2510769
description:
Jun 28 14:20:19 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.72
country_id: 3865483
description:
Jun 28 14:20:48 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.21.208.55
country_id: 6252001
description:
Jun 28 14:21:15 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.21.208.55 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.187.202.158
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.187.202.158: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.199.74
country_id: 2413451
description:
Jun 28 14:22:37 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.199.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 131.222.250.231
country_id: 298795
description:
131.222.250.231 - - [28/Jun/2026:14:22:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473583&pdata=https%253A%252F%252Fcpanel.net.free.netmaster.tg%252F%253Flocale%253Duk&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782656574 HTTP/2.0" 302 0 cpanel.net.free.netmaster.tg "https://cpanel.net.free.netmaster.tg/?locale=uk" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:131.222.250.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.153
country_id: 1835841
description:
Jun 28 14:23:10 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.153 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.170.109.134
country_id: 2635167
description:
185.170.109.134 - - [28/Jun/2026:14:23:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067620&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fla-proposition-du-grad-pour-une-sortie-de-crise-au-togo%252Fpolitique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782656598 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/la-proposition-du-grad-pour-une-sortie-de-crise-au-togo/politique/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.3032.1469 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.170.109.134


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.198.79
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/telephones-2/tecno/tecno-pop1-pro/?add-to-cart=2356||QS:add-to-cart=2356||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.100.122
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-300x300.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.1.62
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-300x199.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.160.38.70
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025-300x188.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.75.166
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/6eef6a2ca9885596df95dd4875db518c_L.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.99.99.163
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/gg-300x200.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.79.98.106
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/8beb68fcdbf9b0e9c01ba146dbbddb40_L-300x200.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.188.184.249
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1P1A5069-768x512.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.91.47
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/6b15e20836ed1e2731b8b4faac93d68e_L.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.77.22
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/gg-768x512.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.167.209.171
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b77bea67db0bbf876072a9f87829ba4b_XL-300x219.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.225.238.120
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b77bea67db0bbf876072a9f87829ba4b_XL.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 14:26:14 +0000] info [cpaneld] 188.166.248.160 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.198.152
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/accesories/gaming-tools/?add-to-cart=132||QS:add-to-cart=132||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.218.153.151
country_id: 130758
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.218.153.151||TA:217.218.153.151||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.30.129.156
country_id: 6251999
description:
Jun 28 14:48:09 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.30.129.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.156
country_id: 6251999
description:
2026-06-28 14:48:11 dovecot_login authenticator failed for H=host-96-30-129-156.public.eastlink.ca ([59.17.27.137]) [96.30.129.156]:35350: 535 Incorrect authentication data (set_id=flanou@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-28 14:48:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36898: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.165.234.28
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-768x512.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.251.200
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/725803952_1346336050758625_8537351566847766639_n-768x469.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 28 14:50:41 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.200.199
country_id: 1835841
description:
Jun 28 14:50:00 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.200.199 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.34.244.133
country_id: 2750405
description:
149.34.244.133 - - [28/Jun/2026:14:51:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6385510&pdata=https%253A%252F%252Ftdn.tg%252Fonmt-formation-medecins-gestion-fiscalite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782658263 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/onmt-formation-medecins-gestion-fiscalite/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.34.244.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 28 14:52:19 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 28 15:01:25 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.48
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-02.168.196.238.48||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.5.123
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-02.138.59.5.123||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-06-28 15:03:19 dovecot_login authenticator failed for H=([103.100.216.56]) [122.187.226.12]:35126: 535 Incorrect authentication data (set_id=gmmo@nic.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.165
country_id: 2395170
description:
41.79.219.165 - - [28/Jun/2026:15:03:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131307&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2024%252F10%252F25%252Fle-bel-hommage-de-latdpdh-a-son-pere-fondateur-raymond-tettekpoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782659008 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2024/10/25/le-bel-hommage-de-latdpdh-a-son-pere-fondateur-raymond-tettekpoe/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.165


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [28/Jun/2026:15:05:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12960877&pdata=http%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782659113 HTTP/1.1" 302 0 24heureinfo.tg "http://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.106.71
country_id: 2921044
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:191.101.106.71||TA:191.101.106.71||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 15:11:42 +0000] info [cpaneld] 188.166.248.160 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.113.227
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.133.113.227||TA:45.133.113.227||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 15:12:04 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.146.243
country_id: 3625428
domain: www.lepoint-actu.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lepoint-actu.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.146.243
country_id: 3625428
domain: www.lepoint-actu.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lepoint-actu.tghttp/www.lepoint-actu.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 28 15:15:59 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.194.48
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/opera/pizza-opera/margherita-3/?add-to-cart=2145||QS:add-to-cart=2145||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.38.183
country_id: 3469034
description:
Jun 28 15:20:44 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.38.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.48.46.95
country_id: 3017382
description:
Jun 28 15:24:29 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.48.46.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-06-28 15:24:31 dovecot_login authenticator failed for H=(138-121-202-90.static.hostdime.com) [5.48.46.95]:57916: 535 Incorrect authentication data (set_id=info@wellcity.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.53.251.101
country_id: 1605651
description:
Jun 28 15:24:27 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.53.251.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Jun 28 15:24:59 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.31
country_id: 298795
description:
Jun 28 15:31:31 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.31 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 136.110.47.231
country_id: 1880251
domain: wages.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:136.110.47.231||TA:136.110.47.231||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.249
country_id: 6252001
description:
Jun 28 15:35:30 ns5 pure-ftpd[537825]: (?@147.185.132.249) [INFO] New connection from 147.185.132.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.241
country_id: 690791
description:
Jun 28 15:35:58 ns5 auth[429394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.121.234.154
country_id: 2542007
domain: ucao-uut.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84842.ucao-uut.tg||ServerName:ucao-uut.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c4fff6984a7c921e11d082f76d3b8ec2a2efc15||Title:0xc30da049||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fdb9af0d402a7f1e84072cc0fed4416ef88d3694||Title:ds4b7oh2xhosqnt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (103.3.221.226) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.60
country_id: 690791
description:
Jun 28 15:42:20 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5525531b7343b5df8370ac6f4bd2ac73eb336b2f||Title:pd4gim01v0tpsw6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.114.237.86
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2107755932 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f629072aee3d6ba40790de27c66f1d47e9de38f||Title:ztrakgf58gr375rr||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e64ab8517aa6ddefd86c6e9b34f19fa57f5edfd5||Title:mehpupr7w4hzpci||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80b6cd9e50b22969fed9ee9948bf8004bcc4c169||Title:2ftk1gfgu0hznszt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.39.24
country_id: 3469034
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0525ee2ac80e1ef11d18e2c4943f043da01c195a||Title:gwoc9dpl86rd8r||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0813a3706fde35969e44acdbb544a79b6166ec90||Title:mnc246nwsgv0awx||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92271db8b47087cfb9763640d703c1a8017b0ab0||Title:b12pb03k1n0btrlswv||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8910ccb5da937c40f898df2b6b37884d6037362e||Title:x196vkksb5jaqzk0ft||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54d9d27ff85bc0a5ab6a26c42bd762e50fb87419||Title:p1kpgbe42gatwxolh7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ddadd36025ec19c457e417547bbdd8b40f4445ae||Title:26jxeu41fcnyl0||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bcff669332c09def4d9de58165e2eab2bcbdb02||Title:dti8bu1wetpuoxamv||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:46cd13cc62a68af23ba438215f2f9dcb7b1f19ab||Title:hoap4q055kv3s8s||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 15:53:55 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.81
country_id: 3469034
description:
Jun 28 15:53:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.81 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.254.201
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.254.201: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.255.89
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.255.89: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.254.195
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.254.195: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0d4a494c38488c0acce1d370ed86b3b647ac4ed||Title:hkvuju2q2nk5i8p||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.255.87
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.255.87: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:327d5d227b5ebe7f70891da388dbcd7747cc3771||Title:x6bv42e8c51gtcwqb||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.255.75
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.255.75: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.254.196
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.254.196: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b129073e72bd28c95bbf93352d2383c694a19d49||Title:vajyfokadbnrj5m||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.75.138.8
country_id: 1210997
description:
103.75.138.8 - - [28/Jun/2026:15:57:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856924&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782662244 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/e4/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.75.138.8


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0fc3113719f2423731ed04da0f435cb53ea6bc7d||Title:72472szcgvhriavjcp||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45b85a315008240120af2246e6822a7840cc28a0||Title:kr8o1j56hv9gfib||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a2bb1c86440499e7262e526c669d25f157a4208||Title:qw7uquhvijzpezsxjm||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6acb54d5673377e8456e43f18a4ccf716a5dd496||Title:4m2go7jb3y92om||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.228.17.83
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/85234265 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e092057f1361d9723c2b96956576b8d0f6e17471||Title:eqbnu2qsurvvcxv||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45bfd2a0cac07b0f84e78bece0443d9c6290fd4b||Title:8gn1ajn6ud69vqqsi||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:be44909e2bd61e130f97c4096b87d289d1d36071||Title:p2yrzlx2ags72a5v||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bea77a32ca0df5f98cad30512c55c26abec03b46||Title:lc0cmldyhubseq8lyc||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5938b7e388018ea938d7fe267db5c967d522904b||Title:08ix80ywfeoh8l||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cf7738aa5ff8c1e6cbdb8739be3a8787a25b403a||Title:el1wp0vnkjy60lk00||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.243
country_id: 2363686
description:
2026-06-28 16:07:27 dovecot_login authenticator failed for H=(Nas) [154.70.82.243]:52368: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.3.221.226
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:65bf47c1521a7aaaafbf9b5653df24527e275874||Title:3rafy5jkidg97vbmk||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-28 16:09:01 +0000] info [cpaneld] 64.111.92.123 - ingertgsarl|1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.196.186
country_id: 174982
description:
2026-06-28 16:10:52 dovecot_plain authenticator failed for H=(localhost) [5.77.196.186]:8866: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.196.186
country_id: 174982
description:
Jun 28 16:10:50 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.196.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.55.209
country_id: 587116
domain: brmn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brmn.tg/index.php/brmn HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.55.209
country_id: 587116
domain: brmn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brmn.tghttp/brmn.tg/brmn HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.127.6.155
country_id: 2328926
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/actualite/detail/1er-mai-2025-une-celebration-unifiee-du-monde-bancaire-et-assurantiel-autour-des-nouvelles-reformes HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.162.147
country_id: 1562822
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/contact HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.157.111.178
country_id: 453733
description:
Jun 28 16:13:00 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.157.111.178 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.29.132
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.29.132: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-28 16:14:25 +0000] info [cpaneld] 64.111.92.123 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.63.249.222
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1708140504 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.107.132.25
country_id: 1814991
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-14.171.107.132.25||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-28 16:15:00 +0000] info [cpaneld] 64.111.92.123 - stephane.o@cafe.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.87.15
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/slick.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.89.163
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/jquery.ui.touch-punch.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.218
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/odometer-theme-default.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.18
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/jquery.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.28
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/jquery.counterup.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.91
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets/css/style.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.89.43
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/waypoints.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.8
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/imagesloaded.pkgd.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.29.195
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/jquery.mCustomScrollbar.concat.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.199
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/wow.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.28.240
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/flaticon.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.28.42
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/popper.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.245
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/slick.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.37
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/bootstrap.min.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.87.234
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/style.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.89.226
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/jquery.filterizr.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.87.7
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/typer.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.28.110
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/slick-theme.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.29
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/jquery-ui.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.14
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/jquery-ui.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.88.247
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/animate.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.84
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/bootstrap.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.98
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/appear.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-28 16:18:15 +0000] info [cpaneld] 64.111.92.123 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.21.67
country_id: 2921044
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/robots.txt HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.87.219
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/animated-slider.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.29.205
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets/css/responsive.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.29.160
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/js/jquery.magnific-popup.min.js HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.89.230
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/fontawesome-all.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 28 16:18:32 ns5 pure-ftpd[555769]: (?@134.122.27.233) [WARNING] Authentication failed for user [contact.mairie.tg]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.69
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/video.min.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.223
country_id: 2750405
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets8/css/jquery.mCustomScrollbar.min.css HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-28 16:20:47 +0000] info [cpaneld] 64.111.92.123 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.142.54.248
country_id: 294640
description:
[2026-06-28 16:20:54 +0000] info [webmaild] 83.142.54.248 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 218.95.78.165
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-16-at-21.19.26.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.114.181.37
country_id: 1269750
description:
45.114.181.37 - - [28/Jun/2026:16:21:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247002&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252F2025%252F07%252F30%252Fles-femmes-daffaires-creent-une-association-pour-stimuler-le-commerce-intra-africain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782663678 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/2025/07/30/les-femmes-daffaires-creent-une-association-pour-stimuler-le-commerce-intra-africain/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.1113.1457 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.114.181.37


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.170.111.66
country_id: 2635167
description:
185.170.111.66 - - [28/Jun/2026:16:22:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315669&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fle-trompe-loeil-du-rapport-doing-bizness%252Feconomie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782663766 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/le-trompe-loeil-du-rapport-doing-bizness/economie/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.6927.1557 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.170.111.66


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.30.244
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:107.173.30.244||TA:107.173.30.244||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.142.76.150
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/291148516 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.18.182
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:167.253.18.182||TA:167.253.18.182||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 16:24:58 +0000] info [cpaneld] 188.166.248.160 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.113
country_id: 1880251
description:
43.173.180.113 - - [28/Jun/2026:16:28:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711962&pdata=http%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782664085 HTTP/1.1" 404 561 dagl.tg "http://dagl.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.135
country_id: 690791
description:
Jun 28 16:31:55 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.135
country_id: 690791
description:
Jun 28 16:32:01 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.249.86.14
country_id: 3469034
description:
Jun 28 16:33:19 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.249.86.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.115.171.29
country_id: 3923057
description:
181.115.171.29 - - [28/Jun/2026:16:33:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064531&pdata=https%253A%252F%252Fdirect7.tg%252Faccessoires-de-mode-52-femmes-formees-par-bilitis-fashion%252Famp&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782664400 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/accessoires-de-mode-52-femmes-formees-par-bilitis-fashion/amp" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.115.171.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.81.56.193
country_id: 1605651
description:
2026-06-28 16:37:29 dovecot_plain authenticator failed for H=(3kg5xyabs8crmkhkiu6) [47.81.56.193]:35564: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.175.65
country_id: 798544
domain: mesyscom.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:turbolte.mesyscom.com||Method:blogger.getUsersBlogs


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.81.56.193
country_id: 1605651
description:
Jun 28 16:37:27 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.81.56.193 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.169
country_id: 1880251
description:
47.128.120.169 - - [28/Jun/2026:16:38:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000741&pdata=https%253A%252F%252Fbelali.tg%252Fabout-traumatic-facts-the-newest-narrator-reduced%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782664684 HTTP/2.0" 302 0 belali.tg "https://belali.tg/about-traumatic-facts-the-newest-narrator-reduced/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.169


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.61.217.190
country_id: 2017370
domain: mesyscom.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Blessings@2022.mesyscom.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.56.56.237
country_id: 1643084
description:
[2026-06-28 16:40:46 +0000] info [cpaneld] 31.56.56.237 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 130.49.78.214
country_id: 2510769
domain: mesyscom.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Cpt_dream_2222.mesyscom.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-28 16:41:40 +0000] info [cpaneld] 64.111.92.123 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 159.26.98.245
country_id: 6252001
domain: matwtogo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/matwtogo.org/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [28/Jun/2026:16:42:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607059&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782664945 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.205.29.148
country_id: 6254930
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/51.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.109.146.162
country_id: 3469034
description:
2026-06-28 16:47:50 dovecot_plain authenticator failed for H=187-109-146-162-wlan.lpnet.com.br ([69.172.210.47]) [187.109.146.162]:31934: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.174.172
country_id: 3469034
description:
2026-06-28 16:48:24 dovecot_plain authenticator failed for H=177.10.174.172.megafox.tec.br ([69.172.210.47]) [177.10.174.172]:26660: 535 Incorrect authentication data (set_id=support@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.109.146.162
country_id: 3469034
description:
2026-06-28 16:47:57 dovecot_login authenticator failed for H=187-109-146-162-wlan.lpnet.com.br ([69.172.210.47]) [187.109.146.162]:31934: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.224.119.10
country_id: 1562822
description:
2026-06-28 16:48:07 dovecot_plain authenticator failed for H=([69.172.210.47]) [171.224.119.10]:38790: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.22
country_id: 226074
description:
Jun 28 16:48:51 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.4.74.237
country_id: 3175395
description:
2026-06-28 16:48:39 dovecot_plain authenticator failed for H=host-87-4-74-237.retail.telecomitalia.it ([69.172.210.47]) [87.4.74.237]:37050: 535 Incorrect authentication data (set_id=marketing@togointerim.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.92.103.206
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/908951792 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.74.237.224
country_id: 3625428
description:
2026-06-28 16:48:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.74.237.224]:40266: 535 Incorrect authentication data (set_id=contact@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.22
country_id: 226074
description:
Jun 28 16:48:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [28/Jun/2026:16:49:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947033&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782665352 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [28/Jun/2026:16:51:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656874&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782665458 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.105.17
country_id: 3469034
description:
Jun 28 16:51:38 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.105.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.226.103.21
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1103991224 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [28/Jun/2026:16:51:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134691&pdata=https%253A%252F%252F154.70.82.246%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782665495 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [28/Jun/2026:16:54:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792920&pdata=https%253A%252F%252F154.70.82.246%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782665678 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.1.151
country_id: 6252001
description:
[2026-06-28 16:54:13 +0000] info [whostmgrd] 165.22.1.151 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.8
country_id: 6252001
description:
205.169.39.8 - - [28/Jun/2026:16:54:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658712&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782665648 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.8


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.252.53.103
country_id: 6252001
description:
142.252.53.103 - - [28/Jun/2026:16:55:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857138&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Fpnp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782665708 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/pnp/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.8698.1549 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.252.53.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.1.151
country_id: 6252001
description:
[2026-06-28 16:55:43 +0000] info [cpaneld] 165.22.1.151 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 28 16:59:09 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.200.199
country_id: 1835841
description:
Jun 28 16:59:35 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.200.199 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.217.141.17
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.217.141.17: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.2
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.2: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.217.141.28
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.217.141.28: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.177.71
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.177.71: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.222.66.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.222.66.74: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.46.133
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.46.133: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.218.119.105
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.218.119.105: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.218.119.97
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.218.119.97: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.199.58
country_id: 3686110
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/administration HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.244.85.248
country_id: 2245662
description:
2026-06-28 17:01:42 dovecot_plain authenticator failed for H=(localhost) [74.244.85.248]:3034: 535 Incorrect authentication data (set_id=kumar@white-ways.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.212.210.139
country_id: 3617476
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/partenaire HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.237.22
country_id: 1168579
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seance-de-restitution-de-la-mission-dimmersion-du-cat-a-lasa-ci HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 17:02:52 +0000] info [cpaneld] 188.166.248.160 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.28.114.152
country_id: 1643084
description:
103.28.114.152 - - [28/Jun/2026:17:03:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934704&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-68275netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782666196 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-68275netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.28.114.152


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.1.151
country_id: 6252001
description:
[2026-06-28 17:04:34 +0000] info [whostmgrd] 165.22.1.151 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.219
country_id: 290557
description:
2026-06-28 17:04:02 H=([217.60.195.219]) [217.60.195.219]:64801 F=<noreply@formlinksystems.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.9.164.93
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/19.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 17:04:58 +0000] info [cpaneld] 188.166.248.160 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.227.188.247
country_id: 1814991
description:
2026-06-28 17:07:22 dovecot_login authenticator failed for H=([111.11.93.87]) [139.227.188.247]:38774: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.227.165
country_id: 2245662
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/deuxieme-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.227.188.247
country_id: 1814991
description:
Jun 28 17:07:20 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.227.188.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.195.152.10
country_id: 2017370
description:
Jun 28 17:08:52 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.195.152.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.195.152.10
country_id: 2017370
description:
Jun 28 17:09:02 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.195.152.10 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 223.111.157.108
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 223.111.157.108: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.18.233
country_id: 6251999
description:
[2026-06-28 17:12:59 +0000] info [cpaneld] 195.63.18.233 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.20.150
country_id: 2921044
description:
[2026-06-28 17:15:40 +0000] info [cpaneld] 195.63.20.150 - vodvpozo "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.20.124
country_id: 2921044
description:
[2026-06-28 17:16:32 +0000] info [cpaneld] 195.63.20.124 - mgvybwur "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.47.200
country_id: 953987
description:
2026-06-28 17:19:46 dovecot_login authenticator failed for H=(factor.makemesome.space) [102.223.47.200]:47616: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.161.126
country_id: 99237
description:
Jun 28 17:19:41 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-06-28 17:19:43 dovecot_login authenticator failed for H=(83x167x79x234.dynamic.saratov.ertelecom.ru) [65.20.161.126]:37776: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.1.151
country_id: 6252001
description:
[2026-06-28 17:18:59 +0000] info [cpaneld] 165.22.1.151 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.135
country_id: 3175395
description:
Jun 28 17:20:38 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.64
country_id: 953987
description:
Jun 28 17:20:51 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.64
country_id: 953987
description:
Jun 28 17:20:59 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.196.73.58
country_id: 3658394
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/2015/10/02/how-technology-is-making-african-fashion-more-accessible/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.180
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.180
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lacs1.mairi&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-06-28 17:35:59 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([74.119.144.57]) [220.246.40.63]:36185: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.148.10.246
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 45.148.10.246: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.170
country_id: 1149361
description:
2026-06-28 17:39:43 dovecot_login authenticator failed for H=([49.125.201.67]) [149.54.62.170]:46446: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.133.112
country_id: 1562822
domain: www.wellcity.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wellcity.tg/derou.tg/public/en HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 17:42:54 +0000] info [cpaneld] 188.166.248.160 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 28 17:49:09 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 28 17:49:12 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.138.6
country_id: 3508796
domain: www.brmn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.138.6
country_id: 3508796
domain: www.brmn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tghttp/www.brmn.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 17:58:31 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.243.240.154
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:196.243.240.154||TA:196.243.240.154||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 209.50.189.145
country_id: 3017382
domain: soena.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:expirefreenetmas||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.222.172.198
country_id: 2661886
description:
104.222.172.198 - - [28/Jun/2026:18:02:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647197&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftikpi-atchadam-sonne-la-mobilisation-generale-le-peuple-togolais-va-reprendre-la-rue%252Fpolitique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782669737 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tikpi-atchadam-sonne-la-mobilisation-generale-le-peuple-togolais-va-reprendre-la-rue/politique/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.9206.1318 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.222.172.198


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.81.146.32
country_id: 3469034
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.81.146.32
country_id: 3469034
domain: letabloid.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tghttp/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.111.162.232
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:190.111.162.232||TA:190.111.162.232||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.148
country_id: 3469034
description:
2026-06-28 18:11:54 dovecot_plain authenticator failed for H=(mesyscom.com) [146.70.98.148]:6182: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.171.247.247
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/696c58 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.59.173.131
country_id: 6252001
description:
[2026-06-28 18:22:03 +0000] info [whostmgrd] 72.59.173.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.197.81
country_id: 6252001
description:
[2026-06-28 18:22:17 +0000] info [whostmgrd] 172.59.197.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.243.92.96
country_id: 2510769
description:
Jun 28 18:22:29 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.243.92.96 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.68
country_id: 1880251
description:
43.173.176.68 - - [28/Jun/2026:18:24:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197355&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fsante%25252Ftuberculose-pour-loms-lheure-est-venue-de-mettre-fin-a-cette-maladie-devastatrice%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782671079 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fsante%2Ftuberculose-pour-loms-lheure-est-venue-de-mettre-fin-a-cette-maladie-devastatrice%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.68


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-28 18:24:53 +0000] info [cpaneld] 103.253.27.219 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-06-28 18:26:51 dovecot_login authenticator failed for H=([210.222.75.179]) [1.227.228.131]:59594: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.215.39
country_id: 3469034
description:
Jun 28 18:26:48 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.215.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2026-06-28 18:26:50 dovecot_login authenticator failed for H=([213.227.245.154]) [189.108.215.39]:48577: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.131
country_id: 1835841
description:
Jun 28 18:26:49 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.251.194
country_id: 6252001
domain: radio.zephyr.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:zephyradmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.179
country_id: 3175395
description:
Jun 28 18:27:36 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-06-28 18:27:28 dovecot_login authenticator failed for H=([91.144.158.62]) [203.252.10.3]:21419: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.185
country_id: 3175395
description:
Jun 28 18:29:30 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.45.162
country_id: 226074
description:
Jun 28 18:30:26 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.45.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-06-28 18:31:48 +0000] info [cpaneld] 44.220.137.203 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.103.30
country_id: 1814991
description:
2026-06-28 18:32:57 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [36.135.103.30]:50200: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-06-28 18:33:11 dovecot_login authenticator failed for H=([98.178.72.4]) [187.9.247.58]:48964: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jun 28 18:34:59 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jun 28 18:35:13 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
country_id: 290557
description:
Jun 28 18:35:28 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.239.99.98
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/768395 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.74.217
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-37.152.232.74.217||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.72.20
country_id: 2363686
description:
[2026-06-28 18:37:02 +0000] info [webmaild] 80.248.72.20 - support@cloud-et-racks.tg "POST /cpsess0531464505/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [80.248.72.20]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.236.11.168
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190822-WA0001.jpg 621w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190822-WA0001-300x204.jpg 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-06-28 18:37:41 +0000] info [cpaneld] 44.220.137.203 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.85.206.148
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1155098744 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-06-28 18:40:48 +0000] info [cpaneld] 44.220.137.203 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.220.137.203
country_id: 6252001
description:
[2026-06-28 18:41:00 +0000] info [cpaneld] 44.220.137.203 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.87.219.186
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:212.87.219.186||TA:212.87.219.186||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.84.10.216
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1301609960 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.160.103.234
country_id: 3489940
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/plans.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.169
country_id: 1880251
description:
47.128.120.169 - - [28/Jun/2026:18:47:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012060&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Fdictature%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782672442 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/dictature/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.169


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.115.218.139
country_id: 3469034
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/aide.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 18:48:54 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jun 28 18:49:15 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.248.142.82
country_id: 2017370
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:109.248.142.82||TA:109.248.142.82||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.185.110.244
country_id: 6252001
description:
54.185.110.244 - - [28/Jun/2026:18:52:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200276&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F475cbf0e239ed73967d9e29c88977295%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782672733 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/475cbf0e239ed73967d9e29c88977295/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.185.110.244


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-28 18:52:20 +0000] info [cpaneld] 129.212.228.74 - ingertgsarl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.231
country_id: 3469034
description:
Jun 28 18:56:30 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.209
country_id: 2395170
description:
Jun 28 18:56:42 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.221
country_id: 3175395
description:
Jun 28 18:56:39 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.221 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.216.165
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.216.165: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.216.164
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.216.164: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.99
country_id: 2300660
description:
Jun 28 18:57:09 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-28 18:57:41 +0000] info [cpaneld] 103.253.27.219 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.213.226.179
country_id: 3175395
description:
2026-06-28 18:59:58 dovecot_plain authenticator failed for H=(dcrdp-uexsov.14sqdg5fyb3enjyvwxfhstuxde.milx.internal.cloudapp.net) [172.213.226.179]:50587: 535 Incorrect authentication data (set_id=sotrane@sotranetogo.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.126.196.55
country_id: 3469034
domain: perfect-labo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83281.perfect-labo.com||ServerName:perfect-labo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78a0d9e1f8b043aca322c4d15aeb62e06b67d781||Title:ou3rnzik6scj0m4e6||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.80.166.147
country_id: 3175395
description:
45.80.166.147 - - [28/Jun/2026:19:03:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185928&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Felection%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782673425 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/election/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.6561.1666 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.80.166.147


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 28 19:05:30 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.135.166
country_id: 1820814
description:
Jun 28 19:05:33 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.135.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 28 19:05:42 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.72.110.164
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 198.72.110.164: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.47.68.111
country_id: 163843
domain: www.vitrinenews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.47.68.111
country_id: 163843
domain: www.vitrinenews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tghttp/www.vitrinenews.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.0.82.255
country_id: 719819
domain: anamek.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:90319.anamek.tg||ServerName:anamek.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0ea52829e8acd8d6d76426d2be6b0da4ee8dc601||Title:0x4a772be7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.42
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-12.168.196.238.42||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.92.127.48
country_id: 3017382
description:
92.92.127.48 - - [28/Jun/2026:19:12:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9990289&pdata=https%253A%252F%252Fwww.wellcity.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782673941 HTTP/2.0" 302 0 www.wellcity.tg "https://www.wellcity.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.92.127.48


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 15.235.118.20
country_id: 6251999
domain: snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.140.99.23
country_id: 6252001
description:
[2026-06-28 19:23:14 +0000] info [cpaneld] 73.140.99.23 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.41.181.178
country_id: 6252001
description:
[2026-06-28 19:23:25 +0000] info [cpaneld] 173.41.181.178 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.120.167.119
country_id: 6252001
description:
[2026-06-28 19:23:17 +0000] info [cpaneld] 69.120.167.119 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.28.44.201
country_id: 6252001
description:
[2026-06-28 19:23:28 +0000] info [cpaneld] 108.28.44.201 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.112.127.54
country_id: 6252001
description:
[2026-06-28 19:23:31 +0000] info [cpaneld] 159.112.127.54 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.77.214.150
country_id: 6252001
description:
[2026-06-28 19:23:35 +0000] info [cpaneld] 73.77.214.150 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.43.167.214
country_id: 6252001
description:
[2026-06-28 19:23:38 +0000] info [cpaneld] 138.43.167.214 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.47.120.103
country_id: 6252001
description:
[2026-06-28 19:23:21 +0000] info [cpaneld] 50.47.120.103 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.165
country_id: 6252001
description:
Jun 28 19:23:57 ns5 pure-ftpd[627323]: (?@147.185.132.165) [INFO] New connection from 147.185.132.165


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.197.147.33
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/863856391 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.204.230.254
country_id: 6252001
description:
[2026-06-28 19:28:55 +0000] info [cpaneld] 69.204.230.254 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.29.70.153
country_id: 6252001
description:
[2026-06-28 19:29:03 +0000] info [cpaneld] 98.29.70.153 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.116.27.101
country_id: 6252001
description:
[2026-06-28 19:29:19 +0000] info [cpaneld] 73.116.27.101 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.13.224.66
country_id: 6252001
description:
[2026-06-28 19:29:06 +0000] info [cpaneld] 38.13.224.66 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.168.54
country_id: 6252001
description:
[2026-06-28 19:29:10 +0000] info [cpaneld] 108.48.168.54 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.217
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.217: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [28/Jun/2026:19:32:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 libertetogo.tg "https://libertetogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658409&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782675159" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [28/Jun/2026:19:32:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658409&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782675159 HTTP/2.0" 404 561 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 46.161.50.108
country_id: 2017370
description:
46.161.50.108 - - [28/Jun/2026:19:32:52 +0000] "GET /favicon.ico HTTP/1.1" 415 587 libertetogo.tg "https://libertetogo.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658409&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782675159" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.161.50.108


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 19:34:07 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.154.247.10
country_id: 2287781
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/sommet-de-la-diaspora-2025-le-president-du-conseil-plaide-pour-la-reparation-des-prejudices/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.101.49.158
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/02/WhatsApp-Image-2025-02-23-at-08.18.46-scaled.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.154.247.10
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sommet-de-la-diaspora-2025-le-president-du-conseil-plaide-pour-la-reparation-des-prejudices/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-28 19:42:33 +0000] info [cpaneld] 129.212.228.74 - enadamso "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 28 19:43:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [28/Jun/2026:19:44:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790820&pdata=http%253A%252F%252F154.70.82.244%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782675874 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.117
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.117: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.67
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.67: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.81
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.81: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.41
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.41: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.240
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.240: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.47
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.47: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.225.204.217
country_id: 6252001
description:
[2026-06-28 19:46:57 +0000] info [cpaneld] 71.225.204.217 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.5.39.86
country_id: 6252001
description:
[2026-06-28 19:47:08 +0000] info [cpaneld] 73.5.39.86 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.125.196.9
country_id: 6252001
description:
[2026-06-28 19:47:11 +0000] info [cpaneld] 69.125.196.9 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.88.91.152
country_id: 6252001
description:
[2026-06-28 19:47:01 +0000] info [cpaneld] 71.88.91.152 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.29.105.167
country_id: 6252001
description:
[2026-06-28 19:47:16 +0000] info [cpaneld] 108.29.105.167 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.22
country_id: 3469034
description:
Jun 28 19:47:39 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.192.4.163
country_id: 6252001
description:
[2026-06-28 19:47:28 +0000] info [cpaneld] 68.192.4.163 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.101.18.73
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2020/02/AGORO-Pr\xc3\xa9sent\xc3\xa9-300x237.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-28 19:52:16 +0000] info [cpaneld] 38.72.131.163 - bawasong "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasong (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 19:53:27 +0000] info [cpaneld] 188.166.248.160 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-28 19:54:34 +0000] info [cpaneld] 103.65.237.227 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 19:56:43 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.131.139.32
country_id: 6252001
description:
[2026-06-28 19:57:30 +0000] info [cpaneld] 135.131.139.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.137.215.97
country_id: 6252001
description:
[2026-06-28 19:57:33 +0000] info [cpaneld] 209.137.215.97 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.90.43.57
country_id: 6252001
description:
[2026-06-28 19:57:38 +0000] info [cpaneld] 172.90.43.57 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.44.17.129
country_id: 6252001
description:
[2026-06-28 19:57:41 +0000] info [cpaneld] 68.44.17.129 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.193.58.163
country_id: 6252001
description:
[2026-06-28 19:57:45 +0000] info [cpaneld] 73.193.58.163 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.187.214.175
country_id: 6252001
description:
[2026-06-28 19:57:48 +0000] info [cpaneld] 76.187.214.175 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.8
country_id: 3469034
description:
Jun 28 19:57:53 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.36.247.120
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1526859917 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.177.100
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/home-v5/?add-to-cart=27||QS:add-to-cart=27||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.51.188.228
country_id: 3175395
description:
Jun 28 19:57:45 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.51.188.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.51.188.228
country_id: 3175395
description:
2026-06-28 19:57:47 dovecot_plain authenticator failed for H=dati.campusroma.it (t8jtiex2neb9gjnb72pv5) [93.51.188.228]:29733: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.184.132.251
country_id: 6252001
description:
[2026-06-28 19:57:53 +0000] info [cpaneld] 68.184.132.251 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.151.159.67
country_id: 3865483
description:
Jun 28 19:56:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.151.159.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.8
country_id: 3469034
description:
Jun 28 19:58:01 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.182
country_id: 3469034
description:
Jun 28 19:59:19 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.61.45.6
country_id: 6252001
description:
[2026-06-28 20:01:18 +0000] info [cpaneld] 73.61.45.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.129.88.123
country_id: 6252001
description:
[2026-06-28 20:01:38 +0000] info [cpaneld] 40.129.88.123 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.230.87.138
country_id: 6252001
description:
[2026-06-28 20:01:43 +0000] info [cpaneld] 47.230.87.138 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.30.43.73
country_id: 6252001
description:
[2026-06-28 20:01:21 +0000] info [cpaneld] 73.30.43.73 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.124.170
country_id: 6252001
description:
[2026-06-28 20:01:24 +0000] info [cpaneld] 172.58.124.170 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.16.37.250
country_id: 6252001
description:
[2026-06-28 20:01:33 +0000] info [cpaneld] 100.16.37.250 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.6.28.34
country_id: 6252001
description:
[2026-06-28 20:01:36 +0000] info [cpaneld] 67.6.28.34 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.226.111.44
country_id: 6252001
description:
[2026-06-28 20:01:28 +0000] info [cpaneld] 75.226.111.44 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.59.181.115
country_id: 6252001
description:
[2026-06-28 20:01:30 +0000] info [cpaneld] 73.59.181.115 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-28 20:03:24 +0000] info [cpaneld] 129.212.228.74 - myxlsnta "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 20:03:28 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 153.117.9.143
country_id: 1168579
description:
153.117.9.143 - - [28/Jun/2026:20:10:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234149&pdata=https%253A%252F%252Fwebmail.whereis.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782677407 HTTP/2.0" 302 0 webmail.whereis.free.netmaster.tg "https://webmail.whereis.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:153.117.9.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.197.49.36
country_id: 6252001
description:
[2026-06-28 20:11:17 +0000] info [cpaneld] 67.197.49.36 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.87.169.220
country_id: 6252001
description:
[2026-06-28 20:11:21 +0000] info [cpaneld] 67.87.169.220 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.218.228.216
country_id: 6252001
description:
[2026-06-28 20:10:58 +0000] info [cpaneld] 72.218.228.216 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.145.247.54
country_id: 6252001
description:
[2026-06-28 20:11:01 +0000] info [cpaneld] 76.145.247.54 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.110.131.17
country_id: 6252001
description:
[2026-06-28 20:11:05 +0000] info [cpaneld] 73.110.131.17 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.121.4.221
country_id: 1814991
description:
2026-06-28 20:11:19 dovecot_login authenticator failed for H=([174.75.211.217]) [123.121.4.221]:51452: 535 Incorrect authentication data (set_id=it@cameg-togo.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 15.235.66.151
country_id: 6251999
domain: sproca.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/1?_fields=id,slug,roles||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 15.235.66.151
country_id: 6251999
domain: conseilnsaftogo.org
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/5?_fields=id,slug,roles||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 20:19:18 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-28 20:19:49 +0000] info [cpaneld] 129.212.228.74 - crepsad "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.233.73
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.180.233.73||TA:194.180.233.73||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.80.114.115
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.120.211
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-21-at-09.35.36-768x768.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.194.98
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/pizzavi/boissons/sodas-pompom-sprite-coca-fanta/?add-to-cart=2011||QS:add-to-cart=2011||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.167.29
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/f7644b56cd0ae537784e23b64857cf80_L.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.159.22
country_id: 690791
description:
Jun 28 20:26:18 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.159.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.21.11
country_id: 2017370
description:
2026-06-28 20:27:20 dovecot_login authenticator failed for H=([197.219.208.38]) [31.173.21.11]:47814: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.25
country_id: 1269750
description:
Jun 28 20:26:55 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.13.110.15
country_id: 3865483
description:
Jun 28 20:27:16 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.13.110.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.91
country_id: 953987
description:
Jun 28 20:30:02 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.93.25.104
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/908c8a HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jun 28 20:33:48 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jun 28 20:33:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.131
country_id: 298795
description:
Jun 28 20:34:12 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.156.87.56
country_id: 2750405
description:
Jun 28 20:36:13 ns5 pure-ftpd[655959]: (?@45.156.87.56) [WARNING] Authentication failed for user [netflix]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.156.87.56
country_id: 2750405
description:
Jun 28 20:35:59 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.156.87.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.156.87.56
country_id: 2750405
description:
2026-06-28 20:36:01 dovecot_plain authenticator failed for H=([45.156.87.56]) [45.156.87.56]:62262: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.206.203
country_id: 2635167
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:151.245.206.203||TA:151.245.206.203||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.126.150
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:23.229.126.150||TA:23.229.126.150||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.236.137
country_id: 2661886
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.112.236.137||TA:92.112.236.137||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.254.39.119
country_id: 2635167
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:155.254.39.119||TA:155.254.39.119||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 20:41:58 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-06-28 20:43:33 dovecot_login authenticator failed for H=(syn-024-142-170-231.biz.spectrum.com) [14.32.231.200]:59152: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.225
country_id: 3469034
description:
Jun 28 20:43:39 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.32.231.200
country_id: 1835841
description:
Jun 28 20:43:31 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.32.231.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 162.19.168.104
country_id: 3017382
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 20:45:29 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.183
country_id: 3277605
description:
Jun 28 20:51:05 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2026-06-28 20:51:07 dovecot_login authenticator failed for H=([67.201.35.147]) [195.222.57.183]:53998: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.76.223
country_id: 2363686
description:
[2026-06-28 20:55:09 +0000] info [cpaneld] 196.170.76.223 NEW jvrzfkho:RH3GqhputS6bIeAj address=196.170.76.223,app=cpaneld,creator=jvrzfkho,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.74.116.239
country_id: 1562822
domain: lac3.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&who=authors&_fields=id,slug||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-28 20:56:29 +0000] info [cpaneld] 167.99.236.81 - afdim "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-28 21:03:50 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:36314: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 28 21:04:40 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-28 21:04:08 +0000] info [cpaneld] 167.99.236.81 - k.eklou "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [28/Jun/2026:21:05:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578586&pdata=http%253A%252F%252Fwww.collation.ucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782680701 HTTP/1.1" 302 0 www.collation.ucao-uut.tg "http://www.collation.ucao-uut.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.121.227
country_id: 3469034
description:
Jun 28 21:05:08 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.121.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.249.86.14
country_id: 3469034
description:
Jun 28 21:05:29 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.249.86.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.37.158.80
country_id: 3175395
description:
84.37.158.80 - - [28/Jun/2026:21:08:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339694&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F07%252F18%252Ftogo-les-prix-des-produits-petroliers-connaissent-une-nouvelle-hausse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782680904 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/07/18/togo-les-prix-des-produits-petroliers-connaissent-une-nouvelle-hausse/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.7892.1685 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.37.158.80


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.140.153
country_id: 1819730
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/WhatsApp-Image-2025-03-25-at-08.46.47.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.122.4
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-10.138.219.122.4||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.144.236.10
country_id: 1861060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/12/Aaa-4.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.160.123
country_id: 2363686
description:
102.64.160.123 - - [28/Jun/2026:21:14:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934440&pdata=https%253A%252F%252Fcaissederetraites.tg%252Fpage%252Fnos-services-61&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782681241 HTTP/2.0" 302 0 caissederetraites.tg "https://caissederetraites.tg/page/nos-services-61" "Mozilla/5.0 (Linux; Android 13; itel A665L Build/TP1A.220624.014) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.91 Mobile Safari/537.36" WL:"0" "com.google.android.apps.searchlite" XFF:"-" CAPTCHA:"0" PEER:102.64.160.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.33.198
country_id: 226074
description:
Jun 28 21:15:28 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-28 21:17:54 +0000] info [cpaneld] 167.99.236.81 - rolle "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.225.60.124
country_id: 3996063
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/boad/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.114.202
country_id: 99237
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.225.60.124
country_id: 3996063
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/boad/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.163.179
country_id: 3469034
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.94.82.142
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-21.23.94.82.142||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.56.77
country_id: 1880251
description:
43.134.56.77 - - [28/Jun/2026:21:22:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262423&pdata=https%253A%252F%252Flacs1.mairie.tg%252Fvisitors%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782681727 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/visitors/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.56.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-28 21:23:43 +0000] info [cpaneld] 167.99.236.81 - pharma "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.125
country_id: 3469034
description:
Jun 28 21:24:46 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.196.83
country_id: 3469034
description:
Jun 28 21:24:25 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.196.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.125
country_id: 3469034
description:
Jun 28 21:25:00 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-28 21:27:24 +0000] info [cpaneld] 129.212.228.74 - pduusmyf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 28 21:27:34 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.96.201
country_id: 1605651
description:
2026-06-28 21:28:17 dovecot_login authenticator failed for H=(aFrItT) [182.53.96.201]:39598: 535 Incorrect authentication data (set_id=kitantoine@atms.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 142.248.80.236
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 142.248.80.236: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.164.51
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/04/tourisme.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.190.195.77
country_id: 3996063
description:
2026-06-28 21:31:10 dovecot_plain authenticator failed for H=fixed-187-190-195-77.totalplay.net (localhost) [187.190.195.77]:12646: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.181.23.28
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b1b5b7 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-28 21:31:53 +0000] info [cpaneld] 129.212.228.74 - mpqypjjp "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.219
country_id: 290557
description:
2026-06-28 21:32:02 H=([217.60.195.219]) [217.60.195.219]:49809 F=<noreply@formlinksystems.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-28 21:33:24 +0000] info [cpaneld] 167.99.236.81 - e.sanvee "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.36.141.7
country_id: 953987
description:
Jun 28 21:33:34 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.36.141.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.187.205.104
country_id: 99237
description:
[2026-06-28 21:33:40 +0000] info [whostmgrd] 185.187.205.104 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.205.104
country_id: 99237
description:
[2026-06-28 21:33:41 +0000] info [whostmgrd] 185.187.205.104 - root "GET /cpsess7587876754/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.64
country_id: 3865483
description:
Jun 28 21:33:58 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.64 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 189.45.197.252
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 189.45.197.252: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 189.45.197.250
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 189.45.197.250: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 189.45.197.242
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 189.45.197.242: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 189.45.197.251
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 189.45.197.251: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 94.228.129.142
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 94.228.129.142: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-28 21:45:13 +0000] info [cpaneld] 129.212.228.74 - websitecpanel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 189.45.197.243
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 189.45.197.243: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.89.173
country_id: 1861060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/Ouverture-de-la-chasse-traditionnelle-en-pays-kabye-en-presence-du-chef-de-lEtat-e1742847185758.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 217.174.149.203
country_id: 732800
domain: educplusmedia.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?context=edit&per_page=100&_fields=slug||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.152.251.123
country_id: 2635167
description:
185.152.251.123 - - [28/Jun/2026:21:46:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6605922&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Fmaivaise-direction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782683169 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/maivaise-direction/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2264.1779 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.152.251.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jun 28 21:47:36 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-06-28 21:47:38 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [119.92.76.210]:53152: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.35.220
country_id: 1814991
description:
2026-06-28 21:49:35 dovecot_login authenticator failed for H=(ucxomp) [123.182.35.220]:5386: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.46.49.49
country_id: 2017370
description:
Jun 28 21:49:50 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.46.49.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.46.49.49
country_id: 2017370
description:
2026-06-28 21:49:52 dovecot_login authenticator failed for H=([180.94.74.94]) [185.46.49.49]:55090: 535 Incorrect authentication data (set_id=office@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.217.64
country_id: 99237
description:
Jun 28 21:50:07 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.217.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-06-28 21:50:09 dovecot_login authenticator failed for H=([58.65.73.22]) [65.20.217.64]:60457: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.202.4
country_id: 99237
description:
Jun 28 21:50:46 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.202.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.35.220
country_id: 1814991
description:
2026-06-28 21:50:07 dovecot_login authenticator failed for H=(ditkg) [123.182.35.220]:5149: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-06-28 21:50:48 dovecot_login authenticator failed for H=([202.72.193.34]) [65.20.202.4]:58051: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.153.34.182
country_id: 2750405
domain: formation.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:formationfreenet||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.20
country_id: 298795
description:
Jun 28 21:53:47 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.157
country_id: 3175395
description:
Jun 28 21:53:47 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.157
country_id: 3175395
description:
Jun 28 21:54:00 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.20
country_id: 298795
description:
Jun 28 21:54:01 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.63
country_id: 2635167
description:
[2026-06-28 21:56:53 +0000] info [cpaneld] 195.63.26.63 - vuvwskxh "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.28
country_id: 2635167
description:
[2026-06-28 21:56:21 +0000] info [cpaneld] 195.63.24.28 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.2
country_id: 2635167
description:
[2026-06-28 21:56:24 +0000] info [cpaneld] 195.63.23.2 - fgbegmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.145
country_id: 2635167
description:
[2026-06-28 21:56:53 +0000] info [cpaneld] 217.181.95.145 - xdkbrmjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.11
country_id: 2635167
description:
[2026-06-28 21:56:08 +0000] info [cpaneld] 195.63.23.11 - pmalabvi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.223
country_id: 2635167
description:
[2026-06-28 21:56:21 +0000] info [cpaneld] 195.63.23.223 - yydrdvav "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.164
country_id: 2635167
description:
[2026-06-28 21:56:37 +0000] info [cpaneld] 217.181.93.164 - pnls "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.225
country_id: 2635167
description:
[2026-06-28 21:55:57 +0000] info [cpaneld] 217.181.94.225 - qfaclpeg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.248
country_id: 2635167
description:
[2026-06-28 21:56:21 +0000] info [cpaneld] 217.181.94.248 - qledpnjw "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.141
country_id: 2635167
description:
[2026-06-28 21:56:36 +0000] info [cpaneld] 195.63.25.141 - rdlizssu "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.180
country_id: 2635167
description:
[2026-06-28 21:56:00 +0000] info [cpaneld] 217.181.95.180 - vejjghdd "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.138
country_id: 2635167
description:
[2026-06-28 21:56:05 +0000] info [cpaneld] 217.181.95.138 - mgvybwur "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.139
country_id: 2635167
description:
[2026-06-28 21:56:21 +0000] info [cpaneld] 217.181.93.139 - aopsacai "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.136
country_id: 2635167
description:
[2026-06-28 21:57:08 +0000] info [cpaneld] 217.181.95.136 - mipbtgnb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.42
country_id: 2635167
description:
[2026-06-28 21:57:08 +0000] info [cpaneld] 195.63.24.42 - phoicdxb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.207
country_id: 2635167
description:
[2026-06-28 21:57:11 +0000] info [cpaneld] 217.181.95.207 - sxoyfjqv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.255
country_id: 2635167
description:
[2026-06-28 21:57:08 +0000] info [cpaneld] 217.181.93.255 - aifkjzqm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.118
country_id: 2635167
description:
[2026-06-28 21:57:08 +0000] info [cpaneld] 195.63.25.118 - doufelg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.39.227.105
country_id: 690791
description:
194.39.227.105 - - [28/Jun/2026:21:57:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13330280&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-204472witems%252Fetidm44in.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782683837 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-204472witems/etidm44in.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.39.227.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.23.188
country_id: 2635167
description:
[2026-06-28 21:57:23 +0000] info [cpaneld] 195.63.23.188 - dmmkifel "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.227
country_id: 2635167
description:
[2026-06-28 21:57:26 +0000] info [cpaneld] 195.63.24.227 - ljrwwgxg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.95.254
country_id: 2635167
description:
[2026-06-28 21:56:56 +0000] info [cpaneld] 217.181.95.254 - wttzshhf "GET / HTTP/1.1" FAILED LOGIN cpaneld: User wttzshhf has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.138.166.217
country_id: 1835841
description:
Jun 28 21:57:55 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.138.166.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-06-28 21:57:57 dovecot_login authenticator failed for H=([207.254.71.129]) [125.138.166.217]:35396: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-06-28 21:58:27 dovecot_login authenticator failed for H=(abts-north-static-031.187.160.122.airtelbroadband.in) [128.185.12.179]:59154: 535 Incorrect authentication data (set_id=dossa.amoussou@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
country_id: 1269750
description:
Jun 28 21:58:25 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.108.109.37
country_id: 1835841
description:
Jun 28 21:59:06 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.108.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-06-28 21:59:08 dovecot_login authenticator failed for H=(098240.cagr.ncyu.edu.tw) [222.108.109.37]:51106: 535 Incorrect authentication data (set_id=dossa.amoussou)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.203
country_id: 1880251
description:
47.128.120.203 - - [28/Jun/2026:21:59:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936024&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fallons-y-seulement-da-vodou%252Flibertinage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782683986 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/allons-y-seulement-da-vodou/libertinage/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.203


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.219
country_id: 290557
description:
2026-06-28 22:00:15 H=([217.60.195.219]) [217.60.195.219]:64666 F=<noreply@formlinksystems.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 22:00:35 +0000] info [cpaneld] 188.166.248.160 - rsgwljmi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rsgwljmi (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.78
country_id: 2635167
description:
[2026-06-28 22:04:15 +0000] info [cpaneld] 5.230.133.78 NEW wcnyaruu:dN93N2w8C76e8W_M address=5.230.133.78,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.27.251.203
country_id: 798544
description:
23.27.251.203 - - [28/Jun/2026:22:05:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067049&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fapres-le-covid-le-terrorisme-business%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782684324 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/apres-le-covid-le-terrorisme-business/non-classe/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.8848.1887 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.27.251.203


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 28 22:09:41 ns5.netmaster.tg cpanel_fileman_hook[693704]: 0 BAILOUT malware detected when upload 'wdccdplm.php' in /home/ifxmoxbf/public_html for user ifxmoxbf


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.187.205.104
country_id: 99237
description:
[2026-06-28 22:09:35 +0000] info [cpaneld] 185.187.205.104 NEW ifxmoxbf:n5XlvmgVmfdu3L00 address=185.187.205.104,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.63.112.26
country_id: 3469034
description:
[2026-06-28 22:09:56 +0000] info [whostmgrd] 189.63.112.26 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-28 22:14:52 +0000] info [cpaneld] 167.99.236.81 - mpqypjjp "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.45.229.77
country_id: 2017370
description:
2026-06-28 22:15:02 dovecot_plain authenticator failed for H=(6cfg6o3ojge088y79dss8) [147.45.229.77]:48024: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.45.229.77
country_id: 2017370
description:
Jun 28 22:15:00 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.45.229.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.61
country_id: 3469034
description:
Jun 28 22:17:19 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
country_id: 1814991
description:
Jun 28 22:21:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.37.155.85
country_id: 3175395
description:
84.37.155.85 - - [28/Jun/2026:22:22:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949399&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fa-quoi-servent-les-organes-de-controle-au-togo%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782685361 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/a-quoi-servent-les-organes-de-controle-au-togo/non-classe/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.1429.1918 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.37.155.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2026-06-28 22:21:58 dovecot_login authenticator failed for H=([70.166.167.37]) [218.94.115.164]:39282: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-28 22:23:46 +0000] info [cpaneld] 188.166.248.160 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 45.126.43.35
country_id: 1643084
domain: wellcity.tg
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php?cmd=<?php echo base64_decode(\"Z2Fuc3Nzc3MgZG9uZWUgbmllaA==\"); ?>||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140967
name: IM360 WAF: PrestaShop PHPUnit Arbitrary Code Execution vulnerability (CVE-2017-9841)
abuser: 45.126.43.35
country_id: 1643084
domain: wellcity.tg
description:
IM360 WAF: PrestaShop PHPUnit Arbitrary Code Execution vulnerability (CVE-2017-9841)||MVN:REQUEST_BODY||RSV:8.21||T:APACHE||MV:<?php echo base64_decode(\"Z2Fuc3Nzc3MgZG9uZWUgbmllaA==\"); ?>||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:26:28 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:26:28 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:26:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30598: 535 Incorrect authentication data (set_id=ver@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:26:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22424: 535 Incorrect authentication data (set_id=volkoff@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:26:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20898: 535 Incorrect authentication data (set_id=vpi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:27:02 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:27:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2416: 535 Incorrect authentication data (set_id=volkoff@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:27:05 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:27:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10876: 535 Incorrect authentication data (set_id=vica@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:27:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52084: 535 Incorrect authentication data (set_id=sell@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:27:01 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:27:00 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:27:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50294: 535 Incorrect authentication data (set_id=album@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:28:35 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:27:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37214: 535 Incorrect authentication data (set_id=supp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:28:03 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:28:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39224: 535 Incorrect authentication data (set_id=lira@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:28:04 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:28:35 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:28:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47492: 535 Incorrect authentication data (set_id=guests@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:28:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29712: 535 Incorrect authentication data (set_id=packages@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.15
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.15: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:29:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44406: 535 Incorrect authentication data (set_id=ftpmail@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:29:23 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.28
country_id: 690791
description:
Jun 28 22:29:17 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:29:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47016: 535 Incorrect authentication data (set_id=pgkrost@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:28:58 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:29:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3468: 535 Incorrect authentication data (set_id=mail16@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:29:17 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.144.90.222
country_id: 2750405
description:
192.144.90.222 - - [28/Jun/2026:22:29:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460774&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fauthor%252Fjojo%252Fpage%252F29%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782685761 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/author/jojo/page/29/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.8703.1016 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.144.90.222


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:29:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5710: 535 Incorrect authentication data (set_id=espanol@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:29:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6346: 535 Incorrect authentication data (set_id=ra@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:29:00 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.15
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.15: 194 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:30:03 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:30:07 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:30:09 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:30:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36114: 535 Incorrect authentication data (set_id=research@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:30:09 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:30:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46154: 535 Incorrect authentication data (set_id=seed@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:30:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20304: 535 Incorrect authentication data (set_id=vakantie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:30:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44442: 535 Incorrect authentication data (set_id=wangyang@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:31:08 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:30:59 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:31:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:8270: 535 Incorrect authentication data (set_id=tur@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.25
country_id: 3175395
description:
Jun 28 22:31:24 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:30:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:30:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22064: 535 Incorrect authentication data (set_id=pegasus@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:30:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16102: 535 Incorrect authentication data (set_id=api@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:30:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:31:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20520: 535 Incorrect authentication data (set_id=shailendra@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:31:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19248: 535 Incorrect authentication data (set_id=bee@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:32:09 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:32:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12292: 535 Incorrect authentication data (set_id=neighbor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:31:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:32:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57124: 535 Incorrect authentication data (set_id=document@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:32:21 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.139.223.252
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1790228373 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:32:02 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:31:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48914: 535 Incorrect authentication data (set_id=blade1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:33:06 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:33:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8228: 535 Incorrect authentication data (set_id=francisco@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:33:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52752: 535 Incorrect authentication data (set_id=francisco@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:33:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51456: 535 Incorrect authentication data (set_id=test-1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:32:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13042: 535 Incorrect authentication data (set_id=tal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:33:16 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:33:19 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:32:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:33:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13524: 535 Incorrect authentication data (set_id=aimee@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:33:58 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:34:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48656: 535 Incorrect authentication data (set_id=exec@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:34:04 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:34:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54130: 535 Incorrect authentication data (set_id=surname@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 220.170.200.72
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/405152080 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:34:02 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:34:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45662: 535 Incorrect authentication data (set_id=poligon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:34:08 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:34:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55086: 535 Incorrect authentication data (set_id=ia@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.162.243.177
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/636263 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:34:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:34:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31052: 535 Incorrect authentication data (set_id=pilar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:35:05 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:35:09 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:35:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26080: 535 Incorrect authentication data (set_id=nats@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:35:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45012: 535 Incorrect authentication data (set_id=store.forum@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:35:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17912: 535 Incorrect authentication data (set_id=fuck@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:35:20 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:35:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28410: 535 Incorrect authentication data (set_id=paged@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:36:08 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:36:06 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:36:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20950: 535 Incorrect authentication data (set_id=sweetpea@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:36:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46616: 535 Incorrect authentication data (set_id=sampling@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:36:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20088: 535 Incorrect authentication data (set_id=paged@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:35:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:35:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:35:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:2226: 535 Incorrect authentication data (set_id=qadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:37:21 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:37:22 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:37:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23610: 535 Incorrect authentication data (set_id=demeter@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:36:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:36:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22960: 535 Incorrect authentication data (set_id=cougars@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-28 22:37:00 +0000] info [cpaneld] 20.212.169.175 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:37:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23194: 535 Incorrect authentication data (set_id=abe@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:37:01 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:37:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16658: 535 Incorrect authentication data (set_id=rutendor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:38:12 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:38:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12936: 535 Incorrect authentication data (set_id=vale@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:38:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55860: 535 Incorrect authentication data (set_id=trace@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:38:10 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:38:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63902: 535 Incorrect authentication data (set_id=merle@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:38:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64278: 535 Incorrect authentication data (set_id=clone@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:38:23 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:38:05 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.10
country_id: 226074
description:
Jun 28 22:38:12 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.171.123
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:heading {\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h2 class=\"wp-block-heading has-text-align-center\">a propos de nous</h2>\n<!-- /wp:heading -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h4 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">histoire de la d\xc3\xa9l\xc3\xa9gation du togo</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">la communaut\xc3\xa9 de lom\xc3\xa9 est la seule communaut\xc3\xa9 camillienne au togo depuis plus de 20 ans. d'autres sont sur le point de na\xc3\xaetre. elle accueillait principalement les postulants camilliens. tout le cycle de philosophie se d\xc3\xa9roulait \xc3\xa0 lom\xc3\xa9, \xc3\xa0 l'institut de philosophie des sal\xc3\xa9siens sis \xc3\xa0 akod\xc3\xa9ss\xc3\xa9wa.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">situation g\xc3\xa9ographique</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">la communaut\xc3\xa9 est situ\xc3\xa9e au quartier b\xc3\xa8-adakpam\xc3\xa8 colas, dans le doyenn\xc3\xa9 de lom\xc3\xa9 est 1, sur le territoire de la paroisse sainte antoine de padoue d'adakpam\xc3\xa8. la c\xc3\xa9r\xc3\xa9monie de pose de sa premi\xc3\xa8re pierre a \xc3\xa9t\xc3\xa9 faite le 15 juillet 2007, au lendemain de la f\xc3\xaate de saint camille de lellis, par mgr philippe fanoko kpodzro.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">objectifs de la cr\xc3\xa9ation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">n\xc3\xa9e de la volont\xc3\xa9 de la province siculo-napolitaine d'\xc3\xa9tendre le charisme camillien au togo, la mission visait \xc3\xa0 d\xc3\xa9localiser le postulat et permettre aux postulants de s'exercer aux premiers soins. le centre de sant\xc3\xa9 saint camille a ouvert ses portes le 22 novembre 2010, lieu de t\xc3\xa9moignage de la mis\xc3\xa9ricorde du christ selon l'esprit de saint camille.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h4 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">cr\xc3\xa9ation (2006)</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>le 24 novembre 2006, deux religieux sont envoy\xc3\xa9s \xc3\xa0 lom\xc3\xa9 pour fonder la mission camillienne : le fr\xc3\xa8re laurent dossou-kiti (b\xc3\xa9nin) et le p\xc3\xa8re l\xc3\xa9on kodjo zotchi (togo).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":433,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/ye-e1782293795163.jpg\" alt=\"\" class=\"wp-image-433\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">le postulat</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>en septembre 2008, la communaut\xc3\xa9 accueille les neuf premiers postulants. sept promotions se succ\xc3\xa9deront jusqu'en 2017. en 2010, les postulants carmes d\xc3\xa9chaux y trouvent aussi un abri temporaire de formation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":424,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/log-e1782293925428.jpg\" alt=\"\" class=\"wp-image-424\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">changement depuis 2017</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>le chapitre d'atrokpocodji d\xc3\xa9cide de transformer la maison de lom\xc3\xa9 en centre de sant\xc3\xa9 avec r\xc3\xa9sidence des religieux. le centre obtient son autorisation de conversion en h\xc3\xb4pital priv\xc3\xa9, r\xc3\xa9alisant le r\xc3\xaave de feue maman pauline tchakpali, donatrice du terrain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":426,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/fac.jpg\" alt=\"\" class=\"wp-image-426\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:heading -->\n<h2 class=\"wp-block-heading\">notre mission</h2>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>\xc2\xab notre institut, de par sa nature, est form\xc3\xa9 de religieux clercs et de religieux la\xc3\xafcs, appel\xc3\xa9s par saint camille p\xc3\xa8res et fr\xc3\xa8res. il a pour objectif le service global du malade dans toutes les dimensions de sa personne. \xc2\xbb<br>\xe2\x80\x94 <em>constitution des ministres des infirmes, article n\xc2\xb043</em></p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>j\xc3\xa9sus-christ est pass\xc3\xa9 en faisant le bien, et ce bien nous voulons le faire pour tous les malades, en toutes circonstances (actes des ap\xc3\xb4tres 10, 38). c'est lui, le malade, qui dit : \xc2\xab j'\xc3\xa9tais malade \xc2\xbb \xe2\x80\x94 \xc2\xab c'est \xc3\xa0 moi que vous l'avez fait \xc2\xbb (cf. mt 25, 31-40).</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>l'activit\xc3\xa9 des professionnels de la sant\xc3\xa9 a une valeur inestimable de service envers la vie \xe2\x80\x94 un engagement profond\xc3\xa9ment humain et chr\xc3\xa9tien, une v\xc3\xa9ritable \xc2\xab forme de t\xc3\xa9moignage chr\xc3\xa9tien \xc2\xbb.</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>prendre soin d'un malade avec amour, c'est s'acquitter d'une mission divine. le professionnel de sant\xc3\xa9 est le bon samaritain qui s'arr\xc3\xaate aupr\xc3\xa8s de l'homme bless\xc3\xa9 et se fait son prochain (cf. lc 10, 29-37).</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>servir la vie, c'est servir dieu en l'homme \xe2\x80\x94 \xc3\xaatre collaborateur de dieu en redonnant la sant\xc3\xa9 au corps malade.<br><em>\xe2\x80\x94 charte des professionnels de la sant\xc3\xa9, cit\xc3\xa9 du vatican, 1995</em></p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"position: relative; border-radius: 0 40px 0 40px; overflow: visible;\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group position: relative; border-radius: 0 40px 40px; overflow: visible; has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h4 class=\"wp-block-heading has-text-align-center\">conseil d'administration</h4>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>p\xc3\xa8re jean pierre pius bida \xe2\x80\x94 provincial, pr\xc3\xa9sident</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re marius yabi \xe2\x80\x94 vicaire provincial, vice-pr\xc3\xa9sident </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re josu\xc3\xa9 loko \xe2\x80\x94 secr\xc3\xa9taire </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re augustin gbegnahoun \xe2\x80\x94 \xc3\x89conome provincial </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>membres : augustin etse, hugues gozo, ferdinand todote, emmanuel dogbovi, ghislain missiho, casimir guezo</li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"position: relative; border-radius: 0 40px 0 40px; overflow: visible;\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group position: relative; border-radius: 0 40px 40px; overflow: visible; has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h3 class=\"wp-block-heading has-text-align-center\">\xc3\x89quipe lom\xc3\xa9</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>p\xc3\xa8re denis kpatkana \xe2\x80\x94 sup\xc3\xa9rieur de la communaut\xc3\xa9 </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re emmanuel beweli \xe2\x80\x94 directeur de l'h\xc3\xb4pital saint camille </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re roberto koudadje \xe2\x80\x94 directeur adjoint </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re augustin etse \xe2\x80\x94 \xc3\x89conome principal</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re rom\xc3\xa9o akpegnon \xe2\x80\x94 \xc3\x89conome adjoint </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re emmanuel dogbovi \xe2\x80\x94 m\xc3\xa9decin chef</li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:html -->\n<style data-wp-block-html=\"css\">\n<style>\n.bls-vision-section {\n    font-family: -apple-system, blinkmacsystemfont, \"segoe ui\", roboto, oxygen-sans, ubuntu, cantarell, \"helvetica neue\", sans-serif; /* police similaire \xc3\xa0 l'image */\n    padding: 40px 20px;\n    background-color: #f8f8f8; /* couleur de fond g\xc3\xa9n\xc3\xa9rale si n\xc3\xa9cessaire */\n    text-align: center;\n}\n\n.bls-vision-header {\n    margin-bottom: 40px;\n}\n\n.bls-subtitle {\n    font-size: 0.9em;\n    color: #666;\n    letter-spacing: 2px;\n    text-transform: uppercase;\n    margin-bottom: 5px;\n}\n\n.bls-title {\n    font-size: 2.5em;\n    color: #333;\n    margin-top: 0;\n    font-weight: bold;\n}\n\n.bls-cards-container {\n    display: flex;\n    flex-wrap: wrap;\n    justify-content: center;\n    gap: 20px;\n    max-width: 1200px;\n    margin: 0 auto;\n}\n\n.bls-card {\n    background-color: #f3f0eb; /* couleur de fond des cartes */\n    border-radius: 15px;\n    padding: 30px;\n    box-shadow: 0 4px 8px rgba(0, 0, 0, 0.05);\n    flex: 1 1 300px; /* permet aux cartes de s'adapter */\n    max-width: 350px;\n    text-align: left;\n    display: flex;\n    flex-direction: column;\n    justify-content: space-between; /* pour pousser l'ic\xc3\xb4ne vers le bas */\n    position: relative; /* pour positionner l'ic\xc3\xb4ne */\n    min-height: 350px; /* hauteur minimale pour l'uniformit\xc3\xa9 */\n}\n\n.bls-card-title {\n    font-size: 1.3em;\n    color: #333;\n    margin-top: 0;\n    margin-bottom: 15px;\n    font-weight: bold;\n    text-transform: uppercase;\n}\n\n.bls-card-text {\n    font-size: 1em;\n    color: #555;\n    line-height: 1.6;\n    margin-bottom: 20px;\n}\n\n.bls-card-icon {\n    width: 50px;\n    height: 50px;\n    background-color: #e0dcd5; /* couleur de fond de l'ic\xc3\xb4ne */\n    border-radius: 50%;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    position: absolute;\n    bottom: 20px;\n    right: 20px;\n}\n\n.bls-card-icon svg {\n    width: 24px;\n    height: 24px;\n    color: #888; /* couleur de l'ic\xc3\xb4ne */\n}\n\n/* responsive adjustments */\n@media (max-width: 768px) {\n    .bls-title {\n        font-size: 2em;\n    }\n    .bls-cards-container {\n        flex-direction: column;\n        align-items: center;\n    }\n    .bls-card {\n        max-width: 90%;\n    }\n}\n\n@media (max-width: 480px) {\n    .bls-vision-section {\n        padding: 20px 10px;\n    }\n    .bls-card {\n        padding: 20px;\n    }\n    .bls-card-title {\n        font-size: 1.1em;\n    }\n    .bls-card-text {\n        font-size: 0.9em;\n    }\n}\n</style>\n</style>\n\n<div class=\"bls-vision-section\">\n    <div class=\"bls-vision-header\">\n        <p class=\"bls-subtitle\">bls</p>\n        <h2 class=\"bls-title\">notre vision</h2>\n    </div>\n\n    <div class=\"bls-cards-container\">\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une vision claire et ambitieuse</h3>\n            <p class=\"bls-card-text\">chez bls, nous croyons qu'entre une id\xc3\xa9e et sa concr\xc3\xa9tisation, il faut un pont solide. notre mission est justement de b\xc3\xa2tir ce pont : transformer l'inspiration en actions concr\xc3\xa8tes. nous visons l'excellence en combinant cr\xc3\xa9ativit\xc3\xa9 audacieuse, efficacit\xc3\xa9 op\xc3\xa9rationnelle et ambition strat\xc3\xa9gique, pour donner vie aux projets de ceux qui osent entreprendre.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-home\"><path d=\"m3 9l9-7 9 7v11a2 2 0 0 1-2 2h5a2 2 0 0 1-2-2z\"></path><polyline points=\"9 22 9 12 15 12 15 22\"></polyline></svg>\n            </div>\n        </div>\n\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une agence moderne et pluridisciplinaire</h3>\n            <p class=\"bls-card-text\">nous sommes bien plus qu'un prestataire. bls, c'est une \xc3\xa9quipe dynamique et passionn\xc3\xa9e, capable de s'adapter \xc3\xa0 chaque d\xc3\xa9fi. gr\xc3\xa2ce \xc3\xa0 notre approche transversale \xe2\x80\x94 allant de l'\xc3\xa9v\xc3\xa9nementiel \xc3\xa0 l'architecture, en passant par la d\xc3\xa9coration, le btp ou les commandes publiques \xe2\x80\x94 nous apportons des solutions sur-mesure, centr\xc3\xa9es sur l'impact et les r\xc3\xa9sultats.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-layers\"><polygon points=\"12 2 2 7 12 12 22 7 12 2\"></polygon><polyline points=\"2 17 12 22 22 17\"></polyline><polyline points=\"2 12 12 17 22 12\"></polyline></svg>\n            </div>\n        </div>\n\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une pr\xc3\x89sence locale, une port\xc3\x89e globale</h3>\n            <p class=\"bls-card-text\">install\xc3\xa9s \xc3\xa0 ago\xc3\xa8-plateau, quartier anom\xc3\xa9, juste en face de la clinique de l'atbef, nous restons proches de nos clients. mais notre accompagnement d\xc3\xa9passe les fronti\xc3\xa8res g\xc3\xa9ographiques : o\xc3\xb9 que vous soyez, nous vous aidons \xc3\xa0 gagner en visibilit\xc3\xa9, \xc3\xa0 faire la diff\xc3\xa9rence et \xc3\xa0 atteindre vos objectifs.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-globe\"><circle cx=\"12\" cy=\"12\" r=\"10\"></circle><line x1=\"2\" y1=\"12\" x2=\"22\" y2=\"12\"></line><path d=\"m12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z\"></path></svg>\n            </div>\n        </div>\n    </div>\n</div>\n<!-- /wp:html -->||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:39:04 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:39:07 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:39:08 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:39:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35972: 535 Incorrect authentication data (set_id=false@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:38:59 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:39:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28132: 535 Incorrect authentication data (set_id=valera@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:39:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8880: 535 Incorrect authentication data (set_id=duplicate@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:39:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:40298: 535 Incorrect authentication data (set_id=neu@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-28 22:40:04 +0000] info [cpaneld] 20.212.169.175 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:40:06 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:40:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56812: 535 Incorrect authentication data (set_id=slctest@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:39:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:39:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49252: 535 Incorrect authentication data (set_id=peck@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:39:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38426: 535 Incorrect authentication data (set_id=peck@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:40:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56814: 535 Incorrect authentication data (set_id=joi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:39:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:39:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12046: 535 Incorrect authentication data (set_id=vitamine@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:40:33 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:41:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32860: 535 Incorrect authentication data (set_id=leela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:41:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24844: 535 Incorrect authentication data (set_id=varmas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:41:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1082: 535 Incorrect authentication data (set_id=1231@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:41:10 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:41:20 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:41:23 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:41:10 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:41:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32874: 535 Incorrect authentication data (set_id=delilah@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:41:57 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:42:10 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:42:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21584: 535 Incorrect authentication data (set_id=cwc@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-28 22:42:00 +0000] info [cpaneld] 167.99.236.81 - a.mathey "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-28 22:42:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8892: 535 Incorrect authentication data (set_id=celebrate@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:41:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1042: 535 Incorrect authentication data (set_id=graciela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-28 22:41:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9038: 535 Incorrect authentication data (set_id=creator@ns5.netmaster.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.171.123
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:heading {\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h2 class=\"wp-block-heading has-text-align-center\">a propos de nous</h2>\n<!-- /wp:heading -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h4 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">histoire de la d\xc3\xa9l\xc3\xa9gation du togo</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">la communaut\xc3\xa9 de lom\xc3\xa9 est la seule communaut\xc3\xa9 camillienne au togo depuis plus de 20 ans. d'autres sont sur le point de na\xc3\xaetre. elle accueillait principalement les postulants camilliens. tout le cycle de philosophie se d\xc3\xa9roulait \xc3\xa0 lom\xc3\xa9, \xc3\xa0 l'institut de philosophie des sal\xc3\xa9siens sis \xc3\xa0 akod\xc3\xa9ss\xc3\xa9wa.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">situation g\xc3\xa9ographique</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">la communaut\xc3\xa9 est situ\xc3\xa9e au quartier b\xc3\xa8-adakpam\xc3\xa8 colas, dans le doyenn\xc3\xa9 de lom\xc3\xa9 est 1, sur le territoire de la paroisse sainte antoine de padoue d'adakpam\xc3\xa8. la c\xc3\xa9r\xc3\xa9monie de pose de sa premi\xc3\xa8re pierre a \xc3\xa9t\xc3\xa9 faite le 15 juillet 2007, au lendemain de la f\xc3\xaate de saint camille de lellis, par mgr philippe fanoko kpodzro.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">objectifs de la cr\xc3\xa9ation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">n\xc3\xa9e de la volont\xc3\xa9 de la province siculo-napolitaine d'\xc3\xa9tendre le charisme camillien au togo, la mission visait \xc3\xa0 d\xc3\xa9localiser le postulat et permettre aux postulants de s'exercer aux premiers soins. le centre de sant\xc3\xa9 saint camille a ouvert ses portes le 22 novembre 2010, lieu de t\xc3\xa9moignage de la mis\xc3\xa9ricorde du christ selon l'esprit de saint camille.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h4 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">cr\xc3\xa9ation (2006)</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>le 24 novembre 2006, deux religieux sont envoy\xc3\xa9s \xc3\xa0 lom\xc3\xa9 pour fonder la mission camillienne : le fr\xc3\xa8re laurent dossou-kiti (b\xc3\xa9nin) et le p\xc3\xa8re l\xc3\xa9on kodjo zotchi (togo).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":433,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/ye-e1782293795163.jpg\" alt=\"\" class=\"wp-image-433\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">le postulat</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>en septembre 2008, la communaut\xc3\xa9 accueille les neuf premiers postulants. sept promotions se succ\xc3\xa9deront jusqu'en 2017. en 2010, les postulants carmes d\xc3\xa9chaux y trouvent aussi un abri temporaire de formation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":424,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/log-e1782293925428.jpg\" alt=\"\" class=\"wp-image-424\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">changement depuis 2017</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>le chapitre d'atrokpocodji d\xc3\xa9cide de transformer la maison de lom\xc3\xa9 en centre de sant\xc3\xa9 avec r\xc3\xa9sidence des religieux. le centre obtient son autorisation de conversion en h\xc3\xb4pital priv\xc3\xa9, r\xc3\xa9alisant le r\xc3\xaave de feue maman pauline tchakpali, donatrice du terrain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":426,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/fac.jpg\" alt=\"\" class=\"wp-image-426\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:heading -->\n<h2 class=\"wp-block-heading\">notre mission</h2>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>\xc2\xab notre institut, de par sa nature, est form\xc3\xa9 de religieux clercs et de religieux la\xc3\xafcs, appel\xc3\xa9s par saint camille p\xc3\xa8res et fr\xc3\xa8res. il a pour objectif le service global du malade dans toutes les dimensions de sa personne. \xc2\xbb<br>\xe2\x80\x94 <em>constitution des ministres des infirmes, article n\xc2\xb043</em></p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>j\xc3\xa9sus-christ est pass\xc3\xa9 en faisant le bien, et ce bien nous voulons le faire pour tous les malades, en toutes circonstances (actes des ap\xc3\xb4tres 10, 38). c'est lui, le malade, qui dit : \xc2\xab j'\xc3\xa9tais malade \xc2\xbb \xe2\x80\x94 \xc2\xab c'est \xc3\xa0 moi que vous l'avez fait \xc2\xbb (cf. mt 25, 31-40).</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>l'activit\xc3\xa9 des professionnels de la sant\xc3\xa9 a une valeur inestimable de service envers la vie \xe2\x80\x94 un engagement profond\xc3\xa9ment humain et chr\xc3\xa9tien, une v\xc3\xa9ritable \xc2\xab forme de t\xc3\xa9moignage chr\xc3\xa9tien \xc2\xbb.</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>prendre soin d'un malade avec amour, c'est s'acquitter d'une mission divine. le professionnel de sant\xc3\xa9 est le bon samaritain qui s'arr\xc3\xaate aupr\xc3\xa8s de l'homme bless\xc3\xa9 et se fait son prochain (cf. lc 10, 29-37).</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>servir la vie, c'est servir dieu en l'homme \xe2\x80\x94 \xc3\xaatre collaborateur de dieu en redonnant la sant\xc3\xa9 au corps malade.<br><em>\xe2\x80\x94 charte des professionnels de la sant\xc3\xa9, cit\xc3\xa9 du vatican, 1995</em></p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"position: relative; border-radius: 0 40px 0 40px; overflow: visible;\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group position: relative; border-radius: 0 40px 40px; overflow: visible; has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h4 class=\"wp-block-heading has-text-align-center\">conseil d'administration</h4>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>p\xc3\xa8re jean pierre pius bida \xe2\x80\x94 provincial, pr\xc3\xa9sident</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re marius yabi \xe2\x80\x94 vicaire provincial, vice-pr\xc3\xa9sident </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re josu\xc3\xa9 loko \xe2\x80\x94 secr\xc3\xa9taire </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re augustin gbegnahoun \xe2\x80\x94 \xc3\x89conome provincial </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>membres : augustin etse, hugues gozo, ferdinand todote, emmanuel dogbovi, ghislain missiho, casimir guezo</li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"position: relative; border-radius: 0 40px 0 40px; overflow: visible;\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group position: relative; border-radius: 0 40px 40px; overflow: visible; has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h3 class=\"wp-block-heading has-text-align-center\">\xc3\x89quipe lom\xc3\xa9</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>p\xc3\xa8re denis kpatkana \xe2\x80\x94 sup\xc3\xa9rieur de la communaut\xc3\xa9 </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re emmanuel beweli \xe2\x80\x94 directeur de l'h\xc3\xb4pital saint camille </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re roberto koudadje \xe2\x80\x94 directeur adjoint </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re augustin etse \xe2\x80\x94 \xc3\x89conome principal</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re rom\xc3\xa9o akpegnon \xe2\x80\x94 \xc3\x89conome adjoint </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re emmanuel dogbovi \xe2\x80\x94 m\xc3\xa9decin chef</li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:html -->\n<style data-wp-block-html=\"css\">\n<style>\n.bls-vision-section {\n    font-family: -apple-system, blinkmacsystemfont, \"segoe ui\", roboto, oxygen-sans, ubuntu, cantarell, \"helvetica neue\", sans-serif; /* police similaire \xc3\xa0 l'image */\n    padding: 40px 20px;\n    background-color: #f8f8f8; /* couleur de fond g\xc3\xa9n\xc3\xa9rale si n\xc3\xa9cessaire */\n    text-align: center;\n}\n\n.bls-vision-header {\n    margin-bottom: 40px;\n}\n\n.bls-subtitle {\n    font-size: 0.9em;\n    color: #666;\n    letter-spacing: 2px;\n    text-transform: uppercase;\n    margin-bottom: 5px;\n}\n\n.bls-title {\n    font-size: 2.5em;\n    color: #333;\n    margin-top: 0;\n    font-weight: bold;\n}\n\n.bls-cards-container {\n    display: flex;\n    flex-wrap: wrap;\n    justify-content: center;\n    gap: 20px;\n    max-width: 1200px;\n    margin: 0 auto;\n}\n\n.bls-card {\n    background-color: #f3f0eb; /* couleur de fond des cartes */\n    border-radius: 15px;\n    padding: 30px;\n    box-shadow: 0 4px 8px rgba(0, 0, 0, 0.05);\n    flex: 1 1 300px; /* permet aux cartes de s'adapter */\n    max-width: 350px;\n    text-align: left;\n    display: flex;\n    flex-direction: column;\n    justify-content: space-between; /* pour pousser l'ic\xc3\xb4ne vers le bas */\n    position: relative; /* pour positionner l'ic\xc3\xb4ne */\n    min-height: 350px; /* hauteur minimale pour l'uniformit\xc3\xa9 */\n}\n\n.bls-card-title {\n    font-size: 1.3em;\n    color: #333;\n    margin-top: 0;\n    margin-bottom: 15px;\n    font-weight: bold;\n    text-transform: uppercase;\n}\n\n.bls-card-text {\n    font-size: 1em;\n    color: #555;\n    line-height: 1.6;\n    margin-bottom: 20px;\n}\n\n.bls-card-icon {\n    width: 50px;\n    height: 50px;\n    background-color: #e0dcd5; /* couleur de fond de l'ic\xc3\xb4ne */\n    border-radius: 50%;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    position: absolute;\n    bottom: 20px;\n    right: 20px;\n}\n\n.bls-card-icon svg {\n    width: 24px;\n    height: 24px;\n    color: #888; /* couleur de l'ic\xc3\xb4ne */\n}\n\n/* responsive adjustments */\n@media (max-width: 768px) {\n    .bls-title {\n        font-size: 2em;\n    }\n    .bls-cards-container {\n        flex-direction: column;\n        align-items: center;\n    }\n    .bls-card {\n        max-width: 90%;\n    }\n}\n\n@media (max-width: 480px) {\n    .bls-vision-section {\n        padding: 20px 10px;\n    }\n    .bls-card {\n        padding: 20px;\n    }\n    .bls-card-title {\n        font-size: 1.1em;\n    }\n    .bls-card-text {\n        font-size: 0.9em;\n    }\n}\n</style>\n</style>\n\n<div class=\"bls-vision-section\">\n    <div class=\"bls-vision-header\">\n        <p class=\"bls-subtitle\">bls</p>\n        <h2 class=\"bls-title\">notre vision</h2>\n    </div>\n\n    <div class=\"bls-cards-container\">\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une vision claire et ambitieuse</h3>\n            <p class=\"bls-card-text\">chez bls, nous croyons qu'entre une id\xc3\xa9e et sa concr\xc3\xa9tisation, il faut un pont solide. notre mission est justement de b\xc3\xa2tir ce pont : transformer l'inspiration en actions concr\xc3\xa8tes. nous visons l'excellence en combinant cr\xc3\xa9ativit\xc3\xa9 audacieuse, efficacit\xc3\xa9 op\xc3\xa9rationnelle et ambition strat\xc3\xa9gique, pour donner vie aux projets de ceux qui osent entreprendre.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-home\"><path d=\"m3 9l9-7 9 7v11a2 2 0 0 1-2 2h5a2 2 0 0 1-2-2z\"></path><polyline points=\"9 22 9 12 15 12 15 22\"></polyline></svg>\n            </div>\n        </div>\n\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une agence moderne et pluridisciplinaire</h3>\n            <p class=\"bls-card-text\">nous sommes bien plus qu'un prestataire. bls, c'est une \xc3\xa9quipe dynamique et passionn\xc3\xa9e, capable de s'adapter \xc3\xa0 chaque d\xc3\xa9fi. gr\xc3\xa2ce \xc3\xa0 notre approche transversale \xe2\x80\x94 allant de l'\xc3\xa9v\xc3\xa9nementiel \xc3\xa0 l'architecture, en passant par la d\xc3\xa9coration, le btp ou les commandes publiques \xe2\x80\x94 nous apportons des solutions sur-mesure, centr\xc3\xa9es sur l'impact et les r\xc3\xa9sultats.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-layers\"><polygon points=\"12 2 2 7 12 12 22 7 12 2\"></polygon><polyline points=\"2 17 12 22 22 17\"></polyline><polyline points=\"2 12 12 17 22 12\"></polyline></svg>\n            </div>\n        </div>\n\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une pr\xc3\x89sence locale, une port\xc3\x89e globale</h3>\n            <p class=\"bls-card-text\">install\xc3\xa9s \xc3\xa0 ago\xc3\xa8-plateau, quartier anom\xc3\xa9, juste en face de la clinique de l'atbef, nous restons proches de nos clients. mais notre accompagnement d\xc3\xa9passe les fronti\xc3\xa8res g\xc3\xa9ographiques : o\xc3\xb9 que vous soyez, nous vous aidons \xc3\xa0 gagner en visibilit\xc3\xa9, \xc3\xa0 faire la diff\xc3\xa9rence et \xc3\xa0 atteindre vos objectifs.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-globe\"><circle cx=\"12\" cy=\"12\" r=\"10\"></circle><line x1=\"2\" y1=\"12\" x2=\"22\" y2=\"12\"></line><path d=\"m12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z\"></path></svg>\n            </div>\n        </div>\n    </div>\n</div>\n<!-- /wp:html -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 28 22:41:56 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:42:08 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 28 22:42:55 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-28 22:42:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62000: 535 Incorrect authentication data (set_id=ruthie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 28 22:42:54 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 28 22:42:58 ns5 auth[540423]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-28 22:43:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38008: 535 Incorrect authentication data (set_id=hit@ns5.netmaster.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.171.123
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:heading {\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h2 class=\"wp-block-heading has-text-align-center\">a propos de nous</h2>\n<!-- /wp:heading -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h4 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">histoire de la d\xc3\xa9l\xc3\xa9gation du togo</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">la communaut\xc3\xa9 de lom\xc3\xa9 est la seule communaut\xc3\xa9 camillienne au togo depuis plus de 20 ans. d'autres sont sur le point de na\xc3\xaetre. elle accueillait principalement les postulants camilliens. tout le cycle de philosophie se d\xc3\xa9roulait \xc3\xa0 lom\xc3\xa9, \xc3\xa0 l'institut de philosophie des sal\xc3\xa9siens sis \xc3\xa0 akod\xc3\xa9ss\xc3\xa9wa.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">situation g\xc3\xa9ographique</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">la communaut\xc3\xa9 est situ\xc3\xa9e au quartier b\xc3\xa8-adakpam\xc3\xa8 colas, dans le doyenn\xc3\xa9 de lom\xc3\xa9 est 1, sur le territoire de la paroisse sainte antoine de padoue d'adakpam\xc3\xa8. la c\xc3\xa9r\xc3\xa9monie de pose de sa premi\xc3\xa8re pierre a \xc3\xa9t\xc3\xa9 faite le 15 juillet 2007, au lendemain de la f\xc3\xaate de saint camille de lellis, par mgr philippe fanoko kpodzro.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"spacing\":{\"padding\":{\"right\":\"0\",\"left\":\"0\",\"bottom\":\"70px\"},\"margin\":{\"top\":\"var:preset|spacing|20\",\"bottom\":\"var:preset|spacing|20\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\"},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;margin-top:var(--wp--preset--spacing--20);margin-bottom:var(--wp--preset--spacing--20);padding-right:0;padding-bottom:70px;padding-left:0\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">objectifs de la cr\xc3\xa9ation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"textalign\":\"left\"}}} -->\n<p class=\"has-text-align-left\">n\xc3\xa9e de la volont\xc3\xa9 de la province siculo-napolitaine d'\xc3\xa9tendre le charisme camillien au togo, la mission visait \xc3\xa0 d\xc3\xa9localiser le postulat et permettre aux postulants de s'exercer aux premiers soins. le centre de sant\xc3\xa9 saint camille a ouvert ses portes le 22 novembre 2010, lieu de t\xc3\xa9moignage de la mis\xc3\xa9ricorde du christ selon l'esprit de saint camille.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h4 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">cr\xc3\xa9ation (2006)</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>le 24 novembre 2006, deux religieux sont envoy\xc3\xa9s \xc3\xa0 lom\xc3\xa9 pour fonder la mission camillienne : le fr\xc3\xa8re laurent dossou-kiti (b\xc3\xa9nin) et le p\xc3\xa8re l\xc3\xa9on kodjo zotchi (togo).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":433,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/ye-e1782293795163.jpg\" alt=\"\" class=\"wp-image-433\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">le postulat</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>en septembre 2008, la communaut\xc3\xa9 accueille les neuf premiers postulants. sept promotions se succ\xc3\xa9deront jusqu'en 2017. en 2010, les postulants carmes d\xc3\xa9chaux y trouvent aussi un abri temporaire de formation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":424,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/log-e1782293925428.jpg\" alt=\"\" class=\"wp-image-424\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"carte-camillienne\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group carte-camillienne has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"},\"elements\":{\"link\":{\"color\":{\"text\":\"var:preset|color|background\"}}}},\"textcolor\":\"background\"} -->\n<h3 class=\"wp-block-heading has-text-align-center has-background-color has-text-color has-link-color\">changement depuis 2017</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>le chapitre d'atrokpocodji d\xc3\xa9cide de transformer la maison de lom\xc3\xa9 en centre de sant\xc3\xa9 avec r\xc3\xa9sidence des religieux. le centre obtient son autorisation de conversion en h\xc3\xb4pital priv\xc3\xa9, r\xc3\xa9alisant le r\xc3\xaave de feue maman pauline tchakpali, donatrice du terrain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":426,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"style\":{\"css\":\"position: absolute;\\nbottom: -28px;\\nright: 24px;\\nwidth: 64px;\\nheight: 64px;\\nbackground-color: #154c7d;\\nborder-radius: 50%;\\npadding: 20px;\\nbox-sizing: border-box;\"}} -->\n<figure class=\"wp-block-image size-full has-custom-css\"><img src=\"https://camilliens.tg/wp-content/uploads/2026/06/fac.jpg\" alt=\"\" class=\"wp-image-426\"/></figure>\n<!-- /wp:image --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:heading -->\n<h2 class=\"wp-block-heading\">notre mission</h2>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>\xc2\xab notre institut, de par sa nature, est form\xc3\xa9 de religieux clercs et de religieux la\xc3\xafcs, appel\xc3\xa9s par saint camille p\xc3\xa8res et fr\xc3\xa8res. il a pour objectif le service global du malade dans toutes les dimensions de sa personne. \xc2\xbb<br>\xe2\x80\x94 <em>constitution des ministres des infirmes, article n\xc2\xb043</em></p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>j\xc3\xa9sus-christ est pass\xc3\xa9 en faisant le bien, et ce bien nous voulons le faire pour tous les malades, en toutes circonstances (actes des ap\xc3\xb4tres 10, 38). c'est lui, le malade, qui dit : \xc2\xab j'\xc3\xa9tais malade \xc2\xbb \xe2\x80\x94 \xc2\xab c'est \xc3\xa0 moi que vous l'avez fait \xc2\xbb (cf. mt 25, 31-40).</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>l'activit\xc3\xa9 des professionnels de la sant\xc3\xa9 a une valeur inestimable de service envers la vie \xe2\x80\x94 un engagement profond\xc3\xa9ment humain et chr\xc3\xa9tien, une v\xc3\xa9ritable \xc2\xab forme de t\xc3\xa9moignage chr\xc3\xa9tien \xc2\xbb.</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>prendre soin d'un malade avec amour, c'est s'acquitter d'une mission divine. le professionnel de sant\xc3\xa9 est le bon samaritain qui s'arr\xc3\xaate aupr\xc3\xa8s de l'homme bless\xc3\xa9 et se fait son prochain (cf. lc 10, 29-37).</p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><!-- wp:paragraph -->\n<p>servir la vie, c'est servir dieu en l'homme \xe2\x80\x94 \xc3\xaatre collaborateur de dieu en redonnant la sant\xc3\xa9 au corps malade.<br><em>\xe2\x80\x94 charte des professionnels de la sant\xc3\xa9, cit\xc3\xa9 du vatican, 1995</em></p>\n<!-- /wp:paragraph --></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"position: relative; border-radius: 0 40px 0 40px; overflow: visible;\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group position: relative; border-radius: 0 40px 40px; overflow: visible; has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:heading {\"level\":4,\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h4 class=\"wp-block-heading has-text-align-center\">conseil d'administration</h4>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>p\xc3\xa8re jean pierre pius bida \xe2\x80\x94 provincial, pr\xc3\xa9sident</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re marius yabi \xe2\x80\x94 vicaire provincial, vice-pr\xc3\xa9sident </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re josu\xc3\xa9 loko \xe2\x80\x94 secr\xc3\xa9taire </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re augustin gbegnahoun \xe2\x80\x94 \xc3\x89conome provincial </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>membres : augustin etse, hugues gozo, ferdinand todote, emmanuel dogbovi, ghislain missiho, casimir guezo</li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:group {\"classname\":\"position: relative; border-radius: 0 40px 0 40px; overflow: visible;\",\"style\":{\"color\":{\"background\":\"#faf6ec\"},\"css\":\"position: relative;\\nborder-radius: 0 40px 0 40px;\\noverflow: visible;\",\"spacing\":{\"padding\":{\"bottom\":\"70px\"}},\"border\":{\"radius\":{\"topleft\":\"20px\",\"topright\":\"20px\",\"bottomleft\":\"20px\",\"bottomright\":\"20px\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group position: relative; border-radius: 0 40px 40px; overflow: visible; has-custom-css has-background\" style=\"border-top-left-radius:20px;border-top-right-radius:20px;border-bottom-left-radius:20px;border-bottom-right-radius:20px;background-color:#faf6ec;padding-bottom:70px\"><!-- wp:heading {\"level\":3,\"style\":{\"typography\":{\"textalign\":\"center\"}}} -->\n<h3 class=\"wp-block-heading has-text-align-center\">\xc3\x89quipe lom\xc3\xa9</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>p\xc3\xa8re denis kpatkana \xe2\x80\x94 sup\xc3\xa9rieur de la communaut\xc3\xa9 </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re emmanuel beweli \xe2\x80\x94 directeur de l'h\xc3\xb4pital saint camille </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re roberto koudadje \xe2\x80\x94 directeur adjoint </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re augustin etse \xe2\x80\x94 \xc3\x89conome principal</li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re rom\xc3\xa9o akpegnon \xe2\x80\x94 \xc3\x89conome adjoint </li>\n<!-- /wp:list-item -->\n\n<!-- wp:list-item -->\n<li>p\xc3\xa8re emmanuel dogbovi \xe2\x80\x94 m\xc3\xa9decin chef</li>\n<!-- /wp:list-item --></ul>\n<!-- /wp:list --></div>\n<!-- /wp:group --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:html -->\n<style data-wp-block-html=\"css\">\n<style>\n.bls-vision-section {\n    font-family: -apple-system, blinkmacsystemfont, \"segoe ui\", roboto, oxygen-sans, ubuntu, cantarell, \"helvetica neue\", sans-serif; /* police similaire \xc3\xa0 l'image */\n    padding: 40px 20px;\n    background-color: #f8f8f8; /* couleur de fond g\xc3\xa9n\xc3\xa9rale si n\xc3\xa9cessaire */\n    text-align: center;\n}\n\n.bls-vision-header {\n    margin-bottom: 40px;\n}\n\n.bls-subtitle {\n    font-size: 0.9em;\n    color: #666;\n    letter-spacing: 2px;\n    text-transform: uppercase;\n    margin-bottom: 5px;\n}\n\n.bls-title {\n    font-size: 2.5em;\n    color: #333;\n    margin-top: 0;\n    font-weight: bold;\n}\n\n.bls-cards-container {\n    display: flex;\n    flex-wrap: wrap;\n    justify-content: center;\n    gap: 20px;\n    max-width: 1200px;\n    margin: 0 auto;\n}\n\n.bls-card {\n    background-color: #f3f0eb; /* couleur de fond des cartes */\n    border-radius: 15px;\n    padding: 30px;\n    box-shadow: 0 4px 8px rgba(0, 0, 0, 0.05);\n    flex: 1 1 300px; /* permet aux cartes de s'adapter */\n    max-width: 350px;\n    text-align: left;\n    display: flex;\n    flex-direction: column;\n    justify-content: space-between; /* pour pousser l'ic\xc3\xb4ne vers le bas */\n    position: relative; /* pour positionner l'ic\xc3\xb4ne */\n    min-height: 350px; /* hauteur minimale pour l'uniformit\xc3\xa9 */\n}\n\n.bls-card-title {\n    font-size: 1.3em;\n    color: #333;\n    margin-top: 0;\n    margin-bottom: 15px;\n    font-weight: bold;\n    text-transform: uppercase;\n}\n\n.bls-card-text {\n    font-size: 1em;\n    color: #555;\n    line-height: 1.6;\n    margin-bottom: 20px;\n}\n\n.bls-card-icon {\n    width: 50px;\n    height: 50px;\n    background-color: #e0dcd5; /* couleur de fond de l'ic\xc3\xb4ne */\n    border-radius: 50%;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    position: absolute;\n    bottom: 20px;\n    right: 20px;\n}\n\n.bls-card-icon svg {\n    width: 24px;\n    height: 24px;\n    color: #888; /* couleur de l'ic\xc3\xb4ne */\n}\n\n/* responsive adjustments */\n@media (max-width: 768px) {\n    .bls-title {\n        font-size: 2em;\n    }\n    .bls-cards-container {\n        flex-direction: column;\n        align-items: center;\n    }\n    .bls-card {\n        max-width: 90%;\n    }\n}\n\n@media (max-width: 480px) {\n    .bls-vision-section {\n        padding: 20px 10px;\n    }\n    .bls-card {\n        padding: 20px;\n    }\n    .bls-card-title {\n        font-size: 1.1em;\n    }\n    .bls-card-text {\n        font-size: 0.9em;\n    }\n}\n</style>\n</style>\n\n<div class=\"bls-vision-section\">\n    <div class=\"bls-vision-header\">\n        <p class=\"bls-subtitle\">bls</p>\n        <h2 class=\"bls-title\">notre vision</h2>\n    </div>\n\n    <div class=\"bls-cards-container\">\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une vision claire et ambitieuse</h3>\n            <p class=\"bls-card-text\">chez bls, nous croyons qu'entre une id\xc3\xa9e et sa concr\xc3\xa9tisation, il faut un pont solide. notre mission est justement de b\xc3\xa2tir ce pont : transformer l'inspiration en actions concr\xc3\xa8tes. nous visons l'excellence en combinant cr\xc3\xa9ativit\xc3\xa9 audacieuse, efficacit\xc3\xa9 op\xc3\xa9rationnelle et ambition strat\xc3\xa9gique, pour donner vie aux projets de ceux qui osent entreprendre.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-home\"><path d=\"m3 9l9-7 9 7v11a2 2 0 0 1-2 2h5a2 2 0 0 1-2-2z\"></path><polyline points=\"9 22 9 12 15 12 15 22\"></polyline></svg>\n            </div>\n        </div>\n\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une agence moderne et pluridisciplinaire</h3>\n            <p class=\"bls-card-text\">nous sommes bien plus qu'un prestataire. bls, c'est une \xc3\xa9quipe dynamique et passionn\xc3\xa9e, capable de s'adapter \xc3\xa0 chaque d\xc3\xa9fi. gr\xc3\xa2ce \xc3\xa0 notre approche transversale \xe2\x80\x94 allant de l'\xc3\xa9v\xc3\xa9nementiel \xc3\xa0 l'architecture, en passant par la d\xc3\xa9coration, le btp ou les commandes publiques \xe2\x80\x94 nous apportons des solutions sur-mesure, centr\xc3\xa9es sur l'impact et les r\xc3\xa9sultats.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-layers\"><polygon points=\"12 2 2 7 12 12 22 7 12 2\"></polygon><polyline points=\"2 17 12 22 22 17\"></polyline><polyline points=\"2 12 12 17 22 12\"></polyline></svg>\n            </div>\n        </div>\n\n        <div class=\"bls-card\">\n            <h3 class=\"bls-card-title\">une pr\xc3\x89sence locale, une port\xc3\x89e globale</h3>\n            <p class=\"bls-card-text\">install\xc3\xa9s \xc3\xa0 ago\xc3\xa8-plateau, quartier anom\xc3\xa9, juste en face de la clinique de l'atbef, nous restons proches de nos clients. mais notre accompagnement d\xc3\xa9passe les fronti\xc3\xa8res g\xc3\xa9ographiques : o\xc3\xb9 que vous soyez, nous vous aidons \xc3\xa0 gagner en visibilit\xc3\xa9, \xc3\xa0 faire la diff\xc3\xa9rence et \xc3\xa0 atteindre vos objectifs.</p>\n            <div class=\"bls-card-icon\">\n                <svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentcolor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-globe\"><circle cx=\"12\" cy=\"12\" r=\"10\"></circle><line x1=\"2\" y1=\"12\" x2=\"22\" y2=\"12\"></line><path d=\"m12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z\"></path></svg>\n            </div>\n        </div>\n    </div>\n</div>\n<!-- /wp:html -->\n\n<!-- wp:html /-->||RSV:8.21||T:APACHE||


