# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.157.154.85
country_id: 6251999
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/11/R\xc3\xa9sultat_Lot3.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 185.69.185.66
country_id: 1218197
description:
Jun 17 05:40:39 ns5 pure-ftpd[1650114]: (?@185.69.185.66) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.117.137.27
country_id: 130758
description:
2026-06-17 05:41:24 H=([185.117.137.218]) [185.117.137.27]:20740 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.38
country_id: 690791
description:
Jun 17 05:42:17 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.38
country_id: 690791
description:
Jun 17 05:42:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.100.120.28
country_id: 2017370
description:
[2026-06-17 05:44:10 +0000] info [cpaneld] 93.100.120.28 - zo "GET /login/?login_only=1&user=zo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:05:43:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937324&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdG5hc2hyaS1jQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dG5hc2hyaS1jQG51cGNvLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.44.225.226
country_id: 1694008
description:
[2026-06-17 05:44:01 +0000] info [cpaneld] 143.44.225.226 - zontalo "GET /login/?login_only=1&user=zontalo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.251.193.6
country_id: 2300660
description:
Jun 17 05:44:06 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.251.193.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.236.103.132
country_id: 2017370
description:
[2026-06-17 05:44:07 +0000] info [cpaneld] 91.236.103.132 - zon "GET /login/?login_only=1&user=zon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.95.140
country_id: 3996063
description:
[2026-06-17 05:43:46 +0000] info [cpaneld] 187.189.95.140 - zontalomemillenium "GET /login/?login_only=1&user=zontalomemillenium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemillenium (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.117.137.27
country_id: 130758
description:
2026-06-17 05:44:09 H=([185.117.137.218]) [185.117.137.27]:13388 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-17 05:44:35 +0000] info [cpaneld] 185.213.83.245 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.160.137
country_id: 3175395
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-45.196.196.160.137||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.114.77
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-45.191.101.114.77||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:45:57 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.175.13.98
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-45.107.175.13.98||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.183.66
country_id: 1269750
description:
Jun 17 05:47:54 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.183.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-06-17 05:47:56 dovecot_login authenticator failed for H=([112.48.16.186]) [125.19.183.66]:39516: 535 Incorrect authentication data (set_id=webmaster@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.8.25.98
country_id: 2750405
description:
45.8.25.98 - - [17/Jun/2026:05:48:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999720&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdmNzcEB2Y3NwLnJ1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675290 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dmNzcEB2Y3NwLnJ1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.8.25.98


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.203
country_id: 6252001
description:
Jun 17 05:48:26 ns5 pure-ftpd[1656181]: (?@45.38.16.203) [WARNING] Authentication failed for user [czqxxxnu]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.251.236.65
country_id: 1562822
description:
[2026-06-17 05:48:48 +0000] info [cpaneld] 171.251.236.65 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.130.39.230
country_id: 3686110
description:
[2026-06-17 05:48:51 +0000] info [cpaneld] 181.130.39.230 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.71.78.22
country_id: 3469034
description:
177.71.78.22 - - [17/Jun/2026:05:48:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841798&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-148219hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675328 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-148219hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.71.78.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.68.187
country_id: 3190538
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_moved.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.97.143.26
country_id: 3585968
description:
[2026-06-17 05:48:55 +0000] info [cpaneld] 138.97.143.26 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.236
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_misconfigured.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.35.33
country_id: 285570
description:
[2026-06-17 05:48:45 +0000] info [cpaneld] 37.231.35.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.156.229.226
country_id: 3686110
description:
38.156.229.226 - - [17/Jun/2026:05:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934281&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-pieton-percute-par-un-camion%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675333 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-pieton-percute-par-un-camion/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.8025.1069 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.156.229.226


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.221.236
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/IP_changed.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.127
country_id: 6252001
domain: mesyscom.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [17/Jun/2026:05:49:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868652&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconstruction-duniversite-a-kpalime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675350 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/construction-duniversite-a-kpalime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 49.228.47.89
country_id: 1605651
description:
2026-06-17 05:50:29 H=([0.0.0.0]) [49.228.47.89]:56513 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:52:53 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:05:53:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935210&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675628 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:53:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300199&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675625 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:53:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328426&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675627 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:54:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:54:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:54:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:54:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.69.128.245
country_id: 6252001
description:
2026-06-17 05:54:40 dovecot_plain authenticator failed for H=pool-173-69-128-245.bltmmd.fios.verizon.net (oxqw99cx60wmw7t6hft3mzpti8) [173.69.128.245]:49757: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:05:54:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118184&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675687 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:54:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933469&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675691 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:05:54:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251104&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675692 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.6.7.235
country_id: 6252001
description:
[2026-06-17 05:55:00 +0000] info [cpaneld] 50.6.7.235 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.30.36.94
country_id: 2921044
description:
212.30.36.94 - - [17/Jun/2026:05:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195913&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Da2FsaW5pbmdyYWRfb2ZmaWNlQGluc3BlY3RvcmF0ZS5ydQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675743 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=a2FsaW5pbmdyYWRfb2ZmaWNlQGluc3BlY3RvcmF0ZS5ydQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.30.36.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.243.40.22
country_id: 2635167
description:
2026-06-17 05:57:30 dovecot_login authenticator failed for H=(uelm.com) [185.243.40.22]:58129: 535 Incorrect authentication data (set_id=nashikoh@cafe.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 49.228.47.89
country_id: 1605651
description:
2026-06-17 06:00:40 H=([0.0.0.0]) [49.228.47.89]:59045 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.169
country_id: 99237
description:
Jun 17 06:02:49 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.214.44.117
country_id: 149590
description:
Jun 17 06:05:33 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.214.44.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-06-17 06:05:35 dovecot_login authenticator failed for H=([192.111.134.12]) [102.214.44.117]:44166: 535 Incorrect authentication data (set_id=info@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [17/Jun/2026:06:06:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778822&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcmJhaGFkdXIuc21zYUBudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676367 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cmJhaGFkdXIuc21zYUBudXBjby5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.54.231
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1.jpeg 1080w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.80.194.66
country_id: 2017370
description:
2026-06-17 06:08:17 H=([80.80.194.66]) [80.80.194.66]:57713 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-17 06:07:50 dovecot_login authenticator failed for H=([74.119.147.213]) [27.71.21.70]:50740: 535 Incorrect authentication data (set_id=pascaljoseph.panassi)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:08:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:08:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:08:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:08:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.163.52.74
country_id: 1814991
description:
2026-06-17 06:07:36 dovecot_login authenticator failed for H=([182.78.87.2]) [123.163.52.74]:43086: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:08:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329708&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676510 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805206&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676510 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:06:08:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739416&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676511 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:08:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121319&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676532 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:08:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382744&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676534 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:08:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236291&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676536 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [17/Jun/2026:06:10:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080989&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdG5hc2hyaS1jQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676614 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dG5hc2hyaS1jQG51cGNvLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.9.0.205
country_id: 2921044
description:
2026-06-17 06:14:18 dovecot_plain authenticator failed for H=static.205.0.9.176.clients.your-server.de [176.9.0.205]:51438: 535 Incorrect authentication data (set_id= sessou.e@inger.tg )


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.9.0.205
country_id: 2921044
description:
2026-06-17 06:14:24 dovecot_login authenticator failed for H=static.205.0.9.176.clients.your-server.de [176.9.0.205]:51438: 535 Incorrect authentication data (set_id= sessou.e@inger.tg )


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jun 17 06:16:18 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.74.176.67
country_id: 6252001
description:
2026-06-17 06:15:41 dovecot_plain authenticator failed for H=(44xf5q7in4x8wl8vbi82yyl39r1u3ie) [66.74.176.67]:55629: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jun 17 06:16:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.5.224.71
country_id: 1814991
description:
Jun 17 06:17:00 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.5.224.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.5.224.71
country_id: 1814991
description:
2026-06-17 06:17:02 dovecot_login authenticator failed for H=([125.19.183.202]) [221.5.224.71]:10476: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.243.128.76
country_id: 798544
description:
109.243.128.76 - - [17/Jun/2026:06:17:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250082&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvalorisation-du-metier-denseignant-letat-togolais-reaffirme-son-engagement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677028 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/valorisation-du-metier-denseignant-letat-togolais-reaffirme-son-engagement/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2122.1244 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.243.128.76


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a599d442717cde19187b623e9b151ce353f8b2d||Title:cfr2nljauprloqq5||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.205.38.218
country_id: 1694008
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/7 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:281af9dbadb7192245046a076694a3c18a307201||Title:w5x7ipdjciyypoiss||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f5b680321a5c2b174794ede31209693226b9c3e||Title:jpa88evgivf2cv127||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:560bc8d91531f32736b5c11be3b5f78d440220bc||Title:x7jdwsyewi635gy||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-17 06:22:03 H=([77.83.39.59]) [77.83.39.59]:58376 F=<qr11@lifecf.org> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:acfafc3f7e4857e8eae673b7947618108be35293||Title:w58kr5d43lo6ym||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d24f278b1950f58220f3bb2b9c00bb0d8dc0082||Title:r7piyau6jbb9vzi59||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:24:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 42.1.70.202
country_id: 1562822
description:
42.1.70.202 - - [17/Jun/2026:06:24:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196845&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14549&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677458 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14549" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.7485.1828 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:42.1.70.202


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:34a365d7c160b671dc472c8af1249b27f46d592f||Title:1f662u83ieeuk5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:23:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316441&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677405 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:23:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677404 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:23:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460871&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677404 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:24:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:24:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:24:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:feb0a1915beedc177f576b1306b6d06c6ce40e7b||Title:ymbp07qngzevz30||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:25:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934180&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677540 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:25:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194480&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677542 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.237.221.207
country_id: 6252001
description:
Jun 17 06:25:49 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.237.221.207 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e9db5e6274a501a0e9212e67cae3342192e80dd||Title:h1a5kal1lvh18wf67||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:25:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250087&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677540 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.237.221.207
country_id: 6252001
description:
2026-06-17 06:25:51 dovecot_plain authenticator failed for H=207.sub-97-237-221.myvzw.com (b09bb4nozhhc7uoge3evt7kkvt17c) [97.237.221.207]:34658: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.242.161.70
country_id: 953987
description:
41.242.161.70 - - [17/Jun/2026:06:25:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277803&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmarche-financier-regional-de-lumoa-crepmf-change-de-denomination-et-devient-amf-umoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677557 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/marche-financier-regional-de-lumoa-crepmf-change-de-denomination-et-devient-amf-umoa/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.3996.1194 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.242.161.70


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.84.115.55
country_id: 1694008
description:
138.84.115.55 - - [17/Jun/2026:06:26:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750937&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frevision-constitutionnelle-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677595 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/revision-constitutionnelle-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9979.1641 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.84.115.55


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e82ff35836bc07767560194dbd08b42386eaf86||Title:iy5erz1n0d3da24mz||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.2
country_id: 2395170
description:
Jun 17 06:29:54 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.43.192.3
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24.jpeg 1080w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.86
country_id: 3469034
description:
2026-06-17 06:31:54 dovecot_plain authenticator failed for H=(waa631wet4x7ayf4pgdvki7xe1j76tdz) [200.174.198.86]:1576: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.168.145.164
country_id: 2363686
domain: www.letabloid.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jun 17 06:35:41 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 06:35:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 17 06:35:57 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.21.56
country_id: 3469034
description:
Jun 17 06:35:57 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.21.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 17 06:36:30 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.211.21.213
country_id: 1269750
description:
Jun 17 06:36:37 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.211.21.213 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:06:36:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644329&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678208 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.225.28
country_id: 1269750
description:
Jun 17 06:37:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.225.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859013&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678226 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 17 06:36:37 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:36:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881751&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678207 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:36:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105386&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678209 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.10.16
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8f8986 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 17 06:36:27 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 17 06:36:52 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jun 17 06:36:45 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 17 06:37:22 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:37:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.229.68
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/8d9bab HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:37:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:37:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 06:38:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:38:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200231&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678306 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:38:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182436&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678307 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:38:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950373&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678307 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.70.203.23
country_id: 719819
description:
146.70.203.23 - - [17/Jun/2026:06:38:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.203.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-17 06:38:56 +0000] info [cpaneld] 185.194.218.134 - amedekabenoit@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 146.70.203.23
country_id: 719819
description:
146.70.203.23 - - [17/Jun/2026:06:40:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333 HTTP/2.0" 404 159 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.203.23


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.38.45.21
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/ac8683 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 61.2.212.194
country_id: 1269750
description:
61.2.212.194 - - [17/Jun/2026:06:43:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737063&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dbi5sYWtzaG1pbmFyYXlhbkB0aGV2YW5pdHljYXNlLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678581 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bi5sYWtzaG1pbmFyYXlhbkB0aGV2YW5pdHljYXNlLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:61.2.212.194


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-17 06:43:38 +0000] info [cpaneld] 134.195.82.55 NEW ifxmoxbf:s45bXUHCjRxgu6gN address=134.195.82.55,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.143
country_id: 3017382
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.922746215118321.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-17 06:44:00 H=([77.83.39.59]) [77.83.39.59]:51691 F=<jgracia@microcreditoscehe.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.42
country_id: 2635167
description:
[2026-06-17 06:44:36 +0000] info [cpaneld] 5.230.133.42 NEW ifxmoxbf:5sACur0ksiN0fO_g address=5.230.133.42,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.82.52
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.737872751216398.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [17/Jun/2026:06:45:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [17/Jun/2026:06:45:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.59.171.230
country_id: 1522867
description:
2026-06-17 06:46:17 H=([95.59.171.230]) [95.59.171.230]:58792 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.111
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/619717029 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.114.67
country_id: 798544
description:
Jun 17 06:47:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.114.67 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.237.148.203
country_id: 99237
description:
37.237.148.203 - - [17/Jun/2026:06:49:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859228&pdata=https%253A%252F%252Fdirect7.tg%252Fjt-de-direct7-les-grands-points-de-lactualite-togolaise-4&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678941 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/jt-de-direct7-les-grands-points-de-lactualite-togolaise-4" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.237.148.203


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.210.123
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/770645540 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.105.247.50
country_id: 6252001
description:
Jun 17 06:50:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.105.247.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.247.50
country_id: 6252001
description:
2026-06-17 06:50:49 dovecot_plain authenticator failed for H=(prlvw0xekjn6rwnfn9q3) [143.105.247.50]:7768: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.6.15.128
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/5c534a HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.168.247
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ced5db HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:52:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:52:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:53:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:53:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592619&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679187 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:06:53:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842521&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679195 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:53:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:53:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119625&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679185 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:53:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6331286&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679186 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:53:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367575&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679191 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:53:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842980&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.218.223.105
country_id: 130758
description:
2026-06-17 06:56:09 H=([217.218.223.105]) [217.218.223.105]:49298 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.234.236
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-1024x684.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-768x513.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-1536x1025.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27.jpeg 1600w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.249.147.151
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2024/04/Recrutement-stagiaire-communication-15124_inputCP_VF.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 43.160.193.182
country_id: 1880251
description:
[2026-06-17 06:56:47 +0000] info [webmaild] 43.160.193.182 - doc.chine@dgdn-togo.tg "GET /cpsess8312897373/3rdparty/roundcube/?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1781679396612&_=1781679396531 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [43.160.240.168] != Current IP Address [43.160.193.182]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.199.188
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:140.99.199.188||TA:140.99.199.188||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-17 06:58:31 +0000] info [cpaneld] 45.61.130.187 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.202.174.175
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/925990857 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.249.232
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/536b7c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.213.160
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_b8f1656fe74917c0889f45e66ede5492.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.130.70
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/css/swiper-bundle.min.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.230.192
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.207.9
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_474f2da06b2a20a3d78b023b42995487.css?ver=1.2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.66.137
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/admin-bar.min.css?ver=6.9.4 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:08:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077077&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680112 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.243.30
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/937645320 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.98
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_fa757170427f0ca61fdafc865cbd50f1.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.236.58.200
country_id: 285570
description:
188.236.58.200 - - [17/Jun/2026:07:08:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933155&pdata=https%253A%252F%252Feducplusmedia.tg%252Fpage%252F11%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680103 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/page/11/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.4663.1900 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.236.58.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:07:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789224&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680110 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459234&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680111 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:09:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197700&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:09:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119532&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680196 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:09:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:09:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:07:09:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985874&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680195 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.125
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_254be852b9f97957423de45bce2e705f.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:09:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:09:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.190.255.224
country_id: 3996063
description:
187.190.255.224 - - [17/Jun/2026:07:09:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907543&pdata=https%253A%252F%252Fcpanel.whereis.free.netmaster.tg%252F%253Flocale%253Dfil&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680175 HTTP/2.0" 302 0 cpanel.whereis.free.netmaster.tg "https://cpanel.whereis.free.netmaster.tg/?locale=fil" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.190.255.224


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.71.46.170
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a1938b HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.246.8
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/dbdde2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.27
country_id: 3865483
description:
Jun 17 07:12:05 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-17 07:13:24 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:41298: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.207.111
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/8a989d HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.112.51.173
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/617388 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.97
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/096f67 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.128.154
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1277401162 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.97.131
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/cfd2d0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.191
country_id: 6252001
description:
Jun 17 07:19:49 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.191
country_id: 6252001
description:
2026-06-17 07:19:51 dovecot_plain authenticator failed for H=(e4a1jq96ddg3nkebegqeu31hezjx7j) [23.129.64.191]:1513: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:20:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871826&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680844 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:07:20:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384798&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680845 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449508&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680847 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.103.185.253
country_id: 1522867
description:
2026-06-17 07:20:38 H=([185.103.185.253]) [185.103.185.253]:15852 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.99.102.93
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1048754699 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.199.148.241
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-1536x1024.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26.jpeg 1600w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.129
country_id: 6290252
description:
Jun 17 07:22:03 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.129 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:23:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:23:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:23:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:07:23:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842269&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681014 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:23:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170713&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681016 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.154.14.49
country_id: 587116
description:
2026-06-17 07:24:07 H=([213.154.14.49]) [213.154.14.49]:52128 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.121
country_id: 732800
description:
Jun 17 07:24:15 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.121 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:23:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:23:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804183&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681010 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:07:23:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984297&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681015 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.121
country_id: 732800
description:
Jun 17 07:24:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.202.84.234
country_id: 130758
description:
2026-06-17 07:26:21 dovecot_plain authenticator failed for H=(c29l0k0bxhflkbauhe3d) [5.202.84.234]:41585: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.234.90.173
country_id: 6252001
description:
23.234.90.173 - - [17/Jun/2026:07:25:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196116&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbmV3Z29hbHMyNUB1a3IubmV0&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681135 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bmV3Z29hbHMyNUB1a3IubmV0" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.234.90.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.69.5.145
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1211571715 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.13
country_id: 3469034
description:
Jun 17 07:27:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.106
country_id: 3865483
description:
Jun 17 07:26:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.66.118.212
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/6c6a5d HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.40.55.173
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/99b2c2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.13
country_id: 3469034
description:
Jun 17 07:27:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.227.228.153
country_id: 6252001
description:
192.227.228.153 - - [17/Jun/2026:07:28:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857682&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252F2472c979c209f4210eb90f3ec0789f65%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681309 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/2472c979c209f4210eb90f3ec0789f65/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.227.228.153


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-17 07:29:23 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=l&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.186.45.28
country_id: 289688
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/346690123 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.236.193.141
country_id: 6252001
description:
2026-06-17 07:32:15 dovecot_plain authenticator failed for H=c-98-236-193-141.hsd1.pa.comcast.net (xb3sqepobdxu5k1q0o7gz9z6oq0g6x) [98.236.193.141]:50536: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.154
country_id: 953987
description:
Jun 17 07:33:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.50.149.0
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1094744546 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.154
country_id: 953987
description:
Jun 17 07:33:21 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.154 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.194.78.226
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.194.78.226||TA:104.194.78.226||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:36:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934178&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681818 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:37:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183573&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681819 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:07:38:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10341271&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681883 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:38:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133978&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681882 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:38:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065008&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681882 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:38:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:38:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:38:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:38:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.88
country_id: 3175395
description:
Jun 17 07:39:29 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.214.73.166
country_id: 298795
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-41.81.214.73.166||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.102.154.143
country_id: 3175395
description:
Jun 17 07:43:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.102.154.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.112.174
country_id: 1269750
description:
Jun 17 07:44:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.112.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-06-17 07:44:12 dovecot_login authenticator failed for H=([211.62.73.218]) [182.78.112.174]:40900: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.102.154.143
country_id: 3175395
description:
Jun 17 07:43:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.102.154.143 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.112.88.156
country_id: 3865483
description:
190.112.88.156 - - [17/Jun/2026:07:43:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788718&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fseries-a-choisir-au-lycee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682218 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/series-a-choisir-au-lycee/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.3873.1343 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.112.88.156


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: modsec
rule: 77350553
name: IM360 WAF: Drupalgeddon test (CVE-2018-7602)
abuser: 107.151.195.176
country_id: 6252001
domain: www.togofeed.com
description:
IM360 WAF: Drupalgeddon test (CVE-2018-7602)||MVN:ARGS_NAMES:\\xc48\\xb8\\xff\\xbb\\x89Bo\\xd7\\x1a\\x14x) \\xb6V\\xf4\"\\x11@6\\x0e\\xec\\x9e\\x009\\xb3\\x18\\x96\\xf0Gtb\\xf7@\\xf8\\x07\\xc2A0\\xc9B\\xc2\\xb2\\r\\xbbAi\\xf9:\\xf3P\\xaf\\v\\xe0\\xf8\\n\\x81\\xb2Zb[#\\x89\\xc5\\x0f\\xa3C\\xc5\\x9fZ\\xf5\\x01\\xae%\\xe0S\\x16\\xa3\\xac*4)\\x11\\x8f\\xa3pW\\x86e\\x02r\\xc1J\\xfbl\\xb9\\xf3nR\\x9b\\xc8\\xef\\x85Np<\\x92R\\xfd9;/Y\\xf8j\\v|\\x03\\xc4\\xc8\\x9b\\xcd]o\\xfc.\\xbb\\b\\x11\\x05\\t\\xb7\\xca\\xc2\\x10\\x02\\xf4\\x1e\\x010h\\x18\\x9d\\x98\\x91\\xc2\\xb42\\xba\\xdcAn\\x18(\\x14\\x06l\\xb5\\x0ce\\xf9\\xbe\\xd7\\x90\\x15\\x04\\xe6\\xcf\\x02\\xc1\\x8e/JJ\\xfc\\x1c\\x15q4d5\\xd0\\xc1\\x8e\\xff\\xbd\\x9b\\x98%\\x94/% 8<\\xda\\x92\\x8cz3\\xb6\\xfd\\xb4xc\\xf3\\x1b\\x10.\\x96X\\x80\"\\xa0\\xe9q||MV:\xc48\xb8\xff\xbb\x89Bo\xd7\x1a\x14x) \xb6V\xf4\"\x11@6\x0e\xec\x9e\x009\xb3\x18\x96\xf0Gtb\xf7@\xf8\x07\xc2A0\xc9B\xc2\xb2\r\xbbAi\xf9:\xf3P\xaf\v\xe0\xf8\n\x81\xb2Zb[#\x89\xc5\x0f\xa3C\xc5\x9fZ\xf5\x01\xae%\xe0S\x16\xa3\xac*4)\x11\x8f\xa3pW\x86e\x02r\xc1J\xfbl\xb9\xf3nR\x9b\xc8\xef\x85Np<\x92R\xfd9;/Y\xf8j\v|\x03\xc4\xc8\x9b\xcd]o\xfc.\xbb\b\x11\x05\t\xb7\xca\xc2\x10\x02\xf4\x1e\x010h\x18\x9d\x98\x91\xc2\xb42\xba\xdcAn\x18(\x14\x06l\xb5\x0ce\xf9\xbe\xd7\x90\x15\x04\xe6\xcf\x02\xc1\x8e/JJ\xfc\x1c\x15q4d5\xd0\xc1\x8e\xff\xbd\x9b\x98%\x94/% 8<\xda\x92\x8cz3\xb6\xfd\xb4xc\xf3\x1b\x10.\x96X\x80\"\xa0\xe9q||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.8.134.180
country_id: 3469034
description:
177.8.134.180 - - [17/Jun/2026:07:44:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471878&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frevalorisation-du-smig-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682267 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/revalorisation-du-smig-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.8972.1213 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.8.134.180


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.72.20
country_id: 2363686
description:
[2026-06-17 07:46:49 +0000] info [webmaild] 80.248.72.20 - support@cloud-et-racks.tg "POST /cpsess9831401522/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [80.248.72.20]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.251.153.60
country_id: 130758
description:
2026-06-17 07:47:30 H=([91.251.153.60]) [91.251.153.60]:4684 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.167.214.64
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-48.87.167.214.64||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:49:08 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:51693: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.208.110.59
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-48.92.208.110.59||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.134.179.79
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.94.134.179.79||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.36.108.114
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.91.36.108.114||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.37.57
country_id: 1819730
description:
[2026-06-17 07:50:13 +0000] info [webmaild] 84.17.37.57 - pmidamon@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.157.40.74
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.87.157.40.74||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.49.238.54
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.91.49.238.54||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:07:53:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644882&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682789 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.51
country_id: 99237
description:
Jun 17 07:52:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.51 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:52:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657942&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682771 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.98.92
country_id: 3865483
description:
Jun 17 07:52:51 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.98.92 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:07:53:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921690&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682782 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:53:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788242&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682783 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.101
country_id: 3175395
description:
Jun 17 07:53:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.101 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:54:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987434&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682842 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:54:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016940&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682844 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.190.201.27
country_id: 3469034
description:
45.190.201.27 - - [17/Jun/2026:07:54:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659222&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpasseport-electronique-du-ghana%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682858 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/passeport-electronique-du-ghana/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.7693.1225 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.190.201.27


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:53:25 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54177: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.215.46.146
country_id: 630336
description:
37.215.46.146 - - [17/Jun/2026:07:54:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592105&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcandidat-au-bepc-se-donne-la-mort-par-pendaison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682890 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/candidat-au-bepc-se-donne-la-mort-par-pendaison/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.6135.1129 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.215.46.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:55:21 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54210: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.251.153.60
country_id: 130758
description:
2026-06-17 07:55:26 H=([91.251.153.60]) [91.251.153.60]:4697 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:55:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.252.220.116
country_id: 798549
description:
[2026-06-17 07:56:20 +0000] info [webmaild] 185.252.220.116 - hboroze@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:55:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:55:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:55:48 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:56:16 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54214: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.236
country_id: 3469034
description:
Jun 17 07:57:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:57:18 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54219: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.252.220.116
country_id: 798549
description:
[2026-06-17 07:57:20 +0000] info [webmaild] 185.252.220.116 - hboroze@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.180.170
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B-300x199.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B-768x510.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.236
country_id: 3469034
description:
Jun 17 07:57:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.194.93
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Apoth\xc3\xa9ose des Evala 2024\xc2\xa0: Le chef de l\xe2\x80\x99\xc3\x89tat f\xc3\xa9licite la jeunesse pour la bonne tenue des festivit\xc3\xa9s||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:58:21 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54222: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 1.26.176.46
country_id: 1814991
description:
2026-06-17 07:59:02 H=([1.26.176.46]) [1.26.176.46]:1585 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.59.115.202
country_id: 6252001
description:
Jun 17 08:00:48 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.59.115.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.115.202
country_id: 6252001
description:
2026-06-17 08:00:50 dovecot_plain authenticator failed for H=(kdjnqic3l7wv1hago5iky3thlp82) [172.59.115.202]:31801: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:08:00:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196679&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683256 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:02:35 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54261: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:03:33 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54267: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:04:42 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54268: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.29.15
country_id: 3625428
description:
Jun 17 08:04:44 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.29.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.29.15
country_id: 3625428
description:
2026-06-17 08:04:46 dovecot_plain authenticator failed for H=(1w7fsu5869g1gnalsmt3neeny4qpfx) [190.89.29.15]:50497: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:05:40 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54269: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:08:07:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314393&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683635 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:08:07:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673836&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683636 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:06:41 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54273: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:08:07:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726056&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683632 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:07:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13136285&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683632 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936026&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683640 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:07:38 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54282: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:08:55 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54289: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:09:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183832&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683741 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208361&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683743 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.74.22.65
country_id: 2077456
description:
114.74.22.65 - - [17/Jun/2026:08:09:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858713&pdata=https%253A%252F%252Fcpanel.appflutter.free.netmaster.tg%252F%253Flocale%253Dfi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683759 HTTP/2.0" 302 0 cpanel.appflutter.free.netmaster.tg "https://cpanel.appflutter.free.netmaster.tg/?locale=fi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.74.22.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:09:24 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54292: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:10:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:10:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:10:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.88.98.130
country_id: 6251999
description:
[2026-06-17 08:11:11 +0000] info [webmaild] 149.88.98.130 - sahondo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.216.166.30
country_id: 3595528
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2.jpeg 1080w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2-300x196.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2-1024x670.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2-768x503.jpeg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:10:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any inquiries pertaining to in which and how to use ||MV:gt;If you have any inquiries pertaining to in which and how to use ||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.43.109
country_id: 3932488
description:
179.6.43.109 - - [17/Jun/2026:08:11:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065515&pdata=https%253A%252F%252Fcpanel.appflutter.free.netmaster.tg%252F%253Flocale%253Dzh_tw&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683883 HTTP/2.0" 302 0 cpanel.appflutter.free.netmaster.tg "https://cpanel.appflutter.free.netmaster.tg/?locale=zh_tw" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.43.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 17 08:13:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 17 08:13:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.211.110.142
country_id: 289688
domain: bawasongroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68398.bawasongroup.com||ServerName:bawasongroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:36e0879042b24c83396308656d42b95abe18ecfa||Title:0xb05407f5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 111.15.169.69
country_id: 1814991
description:
2026-06-17 08:12:27 H=([111.15.169.69]) [111.15.169.69]:64758 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 17 08:13:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.36.194.131
country_id: 272103
description:
Jun 17 08:13:34 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.36.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 08:14:01 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.243.58
country_id: 1814991
description:
Jun 17 08:14:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.243.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-17 08:14:39 +0000] info [cpaneld] 129.212.225.47 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 17 08:14:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 17 08:14:40 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.153.139
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8792c0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.222.2
country_id: 6251999
description:
[2026-06-17 08:16:58 +0000] info [webmaild] 149.50.222.2 - mointie@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.140.29.5
country_id: 298795
description:
[2026-06-17 08:18:47 +0000] info [webmaild] 193.140.29.5 - support@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [17/Jun/2026:08:21:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7062628&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D17&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781684460 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=17" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.140.150.124
country_id: 6252001
description:
2026-06-17 08:23:02 dovecot_plain authenticator failed for H=c-69-140-150-124.hsd1.va.comcast.net (qgqd4baljvhprndr3cq5f7vd74j) [69.140.150.124]:45398: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:23:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750214&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781684621 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:08:23:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988508&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781684636 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:08:24:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789482&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781684653 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-17 08:23:27 +0000] info [cpaneld] 45.61.130.187 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:23:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262980&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781684622 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:08:24:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673932&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781684649 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [17/Jun/2026:08:24:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776174&pdata=http%253A%252F%252Fcloud-et-racks.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781684671 HTTP/1.1" 302 0 cloud-et-racks.tg "http://cloud-et-racks.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.6.247.130
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1638677015 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-17 08:25:25 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "POST /cpsess5584346746/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [41.207.189.253] != Current IP Address [196.170.118.10]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 141.98.101.179
country_id: 2635167
domain: flp-tg.com
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/new-api.db||User:qgqjistz||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:25:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.117.70
country_id: 6252001
description:
2026-06-17 08:25:48 dovecot_plain authenticator failed for H=(9qjly1ih65n6i1u7l3timdf3inrv) [192.145.117.70]:3191: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.3.27
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/85705e HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:25:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:25:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:25:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.132.88
country_id: 2464461
description:
[2026-06-17 08:26:37 +0000] info [cpaneld] 102.31.132.88 - cafetg "GET /execute/Fileman/list_files?dir=/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-17 08:27:43 +0000] info [cpaneld] 5.230.133.56 NEW newistm:V_JsUsmHeteGPGzN address=5.230.133.56,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-17 08:27:38 +0000] info [cpaneld] 5.230.153.169 NEW wgqhqbem:UUt2H_Jg2A36EAIB address=5.230.153.169,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.34
country_id: 2635167
description:
[2026-06-17 08:27:55 +0000] info [cpaneld] 5.230.133.34 NEW cinemafreenetmas:_9m3RxbWc67EIJ7J address=5.230.133.34,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-17 08:27:58 +0000] info [cpaneld] 5.230.133.146 NEW mbyqtkiw:f_x90YpKryC37NRR address=5.230.133.146,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-17 08:27:45 +0000] info [cpaneld] 5.230.133.133 NEW hgfdcvbnk:DIZvBXwfmNbOrnbX address=5.230.133.133,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.233
country_id: 2635167
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.105608555084623.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.94
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.501240948704337.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-17 08:27:40 +0000] info [cpaneld] 107.175.5.140 NEW frtwilql:cDuXquLpKLbD8G5J address=107.175.5.140,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.122
country_id: 2635167
description:
[2026-06-17 08:27:45 +0000] info [cpaneld] 5.230.153.122 NEW vejjghdd:XbIJxwRGTZUTzAqq address=5.230.153.122,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:56842.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ed6e81e14aa88484743923b07924af880e68bcf||Title:0xda1a754c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-17 08:27:42 +0000] info [cpaneld] 64.44.62.24 NEW sahamtg:OxsZ__W5fVb9QFDz address=64.44.62.24,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d9630d30d8695da2b36408bf11952ba9546dcec||Title:0x6aa54020||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.48.215.72
country_id: 1269750
domain: auditeccandco.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38861.auditeccandco.com||ServerName:auditeccandco.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b84c9967ccc57d3011102a0829387b16ec71b8b||Title:0xa050b6e0||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1fb7a9fbbf7969657aef5b53718ff6034aaeae63||Title:0xe3acf5ba||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:164182d5b59f374e01b487aa61d18feab8bf5ffa||Title:0x431c3806||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.103
country_id: 3469034
description:
Jun 17 08:31:30 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.1.217
country_id: 1562822
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/attaque-terroriste-dans-un-camp-militaire-a-ouagadougou-le-togo-epargne-grace-a-la-discipline-de-ses-forces-armees/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.230.33.90
country_id: 3686110
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/internet-haut-debit-la-3g-de-moov-togo-arrive/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:237b5e575aa69657d318ad823c5c0fa3495ac3b5||Title:0x5a8359b0||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa64adf97de4de10cdf32d6f3d73ba25036dc2b9||Title:0x36d80a89||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.81.166.59
country_id: 3469034
description:
170.81.166.59 - - [17/Jun/2026:08:34:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987668&pdata=https%253A%252F%252Fcpanel.smarty.free.netmaster.tg%252F%253Flocale%253Dvi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781685248 HTTP/2.0" 302 0 cpanel.smarty.free.netmaster.tg "https://cpanel.smarty.free.netmaster.tg/?locale=vi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.81.166.59


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.227.28
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/6||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32b57fb96bb54dc71f0343c32712bcee80d2f300||Title:0xdbd90e86||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9fc50720812dbf5c935b7c9befa3362a13fd1dba||Title:0xcb320af9||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09174c7a779b58bb10a8759d6de796e495a67f52||Title:0xbeea58f7||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.179.174
country_id: 1643084
domain: www.derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.derou.tg/Projet_Architecture HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.19.128.85
country_id: 953987
description:
160.19.128.85 - - [17/Jun/2026:08:37:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607069&pdata=https%253A%252F%252Fwebmail.africa.netmaster.tg%252F%253Flocale%253Dfi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781685436 HTTP/2.0" 302 0 webmail.africa.netmaster.tg "https://webmail.africa.netmaster.tg/?locale=fi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.19.128.85


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 104.28.161.253
country_id: 2510769
description:
[2026-06-17 08:37:24 +0000] info [whostmgrd] 104.28.161.253 PURGE root:1cBNIMjbEnSgdFdU badpass [cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [104.28.161.253]]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c4d550c3adbf6bda5ec49cfc0ccbe1e04b655598||Title:0x2dda7970||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.12.171.138
country_id: 3865483
description:
186.12.171.138 - - [17/Jun/2026:08:37:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184604&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-122251netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781685475 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-122251netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.12.171.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.252.94
country_id: 1668284
description:
Jun 17 08:38:01 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.252.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.161.253
country_id: 2510769
description:
[2026-06-17 08:37:24 +0000] info [whostmgrd] 104.28.161.253 - root "GET /cpsess5218057969/?=undefined&login=1&post_login=31770767867698 HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [104.28.161.253]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.83.39.173
country_id: 1269750
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbcde7cb7788bc58527b717f5865a729e1ffcb4f||Title:0x3ebb67cb||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-17 08:38:58 +0000] info [webmaild] 160.242.195.10 - fkossivi@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.235.33.46
country_id: 6251999
description:
2026-06-17 08:38:37 dovecot_plain authenticator failed for H=ip46.ip-15-235-33.net (ypsk0c8lrcz5b8i7gkuagc) [15.235.33.46]:54853: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:39:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920862&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781685562 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:39:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327235&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781685562 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:08:39:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078310&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781685594 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:08:40:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722758&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781685598 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:42:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:42:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:42:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.251.204.215
country_id: 1527747
description:
2026-06-17 08:42:34 H=([46.251.213.155]) [46.251.204.215]:57848 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 08:43:51 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:37522: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.39.147
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a67749 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-17 08:49:09 +0000] info [webmaild] 160.242.199.70 - yadjor@caissederetraites.tg "POST /cpsess1761912462/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [160.242.199.70]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.77.49.223
country_id: 3190538
description:
193.77.49.223 - - [17/Jun/2026:08:49:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10056094&pdata=https%253A%252F%252Fmacite.tg%252F2022%252F12%252F23%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686138 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2022/12/23/page/2/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2590.1681 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.77.49.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.17.108.85
country_id: 6290252
description:
Jun 17 08:49:55 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.17.108.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.197.8.93
country_id: 3175395
description:
2026-06-17 08:50:47 dovecot_login authenticator failed for H=(185.197.8.93) [185.197.8.93]:54949: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.177.188.50
country_id: 2464461
description:
[2026-06-17 08:50:25 +0000] info [cpaneld] 196.177.188.50 - kpmg "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.93
country_id: 3175395
description:
Jun 17 08:50:45 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.133.37.149
country_id: 1880251
description:
Jun 17 08:52:20 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.133.37.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.133.37.149
country_id: 1880251
description:
2026-06-17 08:52:22 dovecot_plain authenticator failed for H=(fluwzouv4rraa97mf) [43.133.37.149]:33463: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:52:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922918&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686372 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:52:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450119&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686373 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-17 08:53:11 +0000] info [cpaneld] 134.195.83.234 NEW wwayrzpl:ttpvEdgRtzc6833c address=134.195.83.234,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:08:54:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7195550&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686465 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:54:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068642&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686463 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:08:54:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727642&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686467 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:08:54:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393240&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686484 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.120.28.109
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-carnet-numerique-kondjigbale-pour-moderniser-lhabitude-dans-le-secteur-de-sante/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.120.28.109
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-le-carnet-numerique-kondjigbale-pour-moderniser-lhabitude-dans-le-secteur-de-sante/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:55:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:55:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:55:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:55:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.250.6
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/WhatsApp-Image-2024-10-11-at-10.08.31-PM-1024x722-1.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/10/WhatsApp-Image-2024-10-11-at-10.08.31-PM-1024x722-1-300x212.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/10/WhatsApp-Image-2024-10-11-at-10.08.31-PM-1024x722-1-768x542.jpeg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.7.12.78
country_id: 1522867
description:
2026-06-17 08:56:48 H=([195.7.12.78]) [195.7.12.78]:62646 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11009
name: WHM login success
abuser: 104.28.161.253
country_id: 2510769
description:
[2026-06-17 08:57:50 +0000] info [whostmgrd] 104.28.161.253 NEW root:i7vGh_l4NTHy_Ehm address=104.28.161.253,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.78.130.252
country_id: 6252001
description:
2026-06-17 08:57:24 dovecot_plain authenticator failed for H=c-73-78-130-252.hsd1.co.comcast.net (0uhgom6xlxn1r6rwah77c4841) [73.78.130.252]:57249: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 145.255.178.174
country_id: 1522867
description:
2026-06-17 08:59:04 H=([145.255.178.174]) [145.255.178.174]:17298 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.84.107.33
country_id: 2661886
description:
45.84.107.33 - doufelg [17/Jun/2026:08:59:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133935&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781686790 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.84.107.33


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.7.12.78
country_id: 1522867
description:
2026-06-17 09:01:22 H=([195.7.12.78]) [195.7.12.78]:51760 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p>dans un monde \xc3\xa9conomique en mutation rapide o\xc3\xb9 le digital redessine les r\xc3\xa8gles du jeu entrepreneurial, l\xe2\x80\x99association des femmes cheffes d\xe2\x80\x99entreprise du togo (afcet) a marqu\xc3\xa9 une halte strat\xc3\xa9gique. le 16 juin 2026, elle a c\xc3\xa9l\xc3\xa9br\xc3\xa9 son 25e anniversaire \xc3\xa0 travers une conf\xc3\xa9rence-d\xc3\xa9bat d\xe2\x80\x99envergure autour d\xe2\x80\x99un th\xc3\xa8me central : \xc2\xab les entreprises f\xc3\xa9minines \xc3\xa0 l\xe2\x80\x99\xc3\xa8re du num\xc3\xa9rique et du digital \xc2\xbb. une rencontre dense, rassemblant entrepreneures, expertes du num\xc3\xa9rique, responsables institutionnels et partenaires techniques, tous r\xc3\xa9unis pour interroger l\xe2\x80\x99avenir des entreprises dirig\xc3\xa9es par des femmes face aux d\xc3\xa9fis de la transformation digitale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des \xc3\xa9changes, une pr\xc3\xa9occupation majeure s\xe2\x80\x99est impos\xc3\xa9e : comment renforcer la comp\xc3\xa9titivit\xc3\xa9 des entreprises f\xc3\xa9minines dans un environnement o\xc3\xb9 la ma\xc3\xaetrise des outils num\xc3\xa9riques devient un levier d\xc3\xa9cisif de survie et de croissance. pendant plusieurs heures de discussions, les participantes ont explor\xc3\xa9 les voies possibles d\xe2\x80\x99une adaptation efficace \xc3\xa0 cette nouvelle donne \xc3\xa9conomique mondiale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lire l'article : <a>cybers\xc3\xa9curit\xc3\xa9 au togo : l\xe2\x80\x99ancy outille les m\xc3\xa9dias \xc3\xa0 kpalim\xc3\xa9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://leadelles.tg/index.php/author/carole/\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour la pr\xc3\xa9sidente de l\xe2\x80\x99afcet, annie gon\xc3\xa7alves gbado\xc3\xa8, ce jubil\xc3\xa9 d\xe2\x80\x99argent d\xc3\xa9passe le simple cadre comm\xc3\xa9moratif. il s\xe2\x80\x99agit plut\xc3\xb4t d\xe2\x80\x99un tournant strat\xc3\xa9gique pour l\xe2\x80\x99organisation, appel\xc3\xa9e \xc3\xa0 se r\xc3\xa9inventer. \xc2\xab vingt-cinq ans, c\xe2\x80\x99est beaucoup et c\xe2\x80\x99est peu \xc3\xa0 la fois dans la vie d\xe2\x80\x99une organisation. cette conf\xc3\xa9rence doit susciter un nouvel \xc3\xa9lan aupr\xc3\xa8s des femmes entrepreneures et les encourager \xc3\xa0 s\xe2\x80\x99approprier davantage les outils du num\xc3\xa9rique \xc2\xbb, a-t-elle indiqu\xc3\xa9. dans cette dynamique, elle a annonc\xc3\xa9 une s\xc3\xa9rie d\xe2\x80\x99initiatives futures, notamment des s\xc3\xa9minaires, des ateliers de sensibilisation et des actions de proximit\xc3\xa9 destin\xc3\xa9es \xc3\xa0 renforcer les capacit\xc3\xa9s des femmes, en particulier celles des zones rurales, tout en \xc3\xa9largissant l\xe2\x80\x99implantation de l\xe2\x80\x99association \xc3\xa0 l\xe2\x80\x99int\xc3\xa9rieur du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>replac\xc3\xa9e au centre des d\xc3\xa9bats, la notion m\xc3\xaame de transformation digitale a fait l\xe2\x80\x99objet d\xe2\x80\x99un \xc3\xa9clairage approfondi. une distinction essentielle a \xc3\xa9t\xc3\xa9 apport\xc3\xa9e par m\xc3\xa9dissa sama, pr\xc3\xa9sidente de la conf\xc3\xa9d\xc3\xa9ration des jeunes entreprises et start-up du togo et pan\xc3\xa9liste. selon elle, l\xe2\x80\x99usage d\xe2\x80\x99outils num\xc3\xa9riques ne saurait \xc3\xaatre confondu avec une v\xc3\xa9ritable digitalisation de l\xe2\x80\x99entreprise. elle tranche avec clart\xc3\xa9 : \xc2\xab utiliser des outils num\xc3\xa9riques n\xe2\x80\x99est pas digitaliser son entreprise. la digitalisation consiste \xc3\xa0 repenser l\xe2\x80\x99organisation de l\xe2\x80\x99entreprise, \xc3\xa0 connecter les informations, les processus et les services pour gagner en efficacit\xc3\xa9 et en comp\xc3\xa9titivit\xc3\xa9 \xc2\xbb, a-t-elle expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans un contexte marqu\xc3\xa9 par l\xe2\x80\x99essor fulgurant de l\xe2\x80\x99intelligence artificielle, elle estime que de nouvelles opportunit\xc3\xa9s s\xe2\x80\x99ouvrent aux entrepreneures africaines. celles-ci peuvent d\xc3\xa9sormais acc\xc3\xa9der \xc3\xa0 des march\xc3\xa9s internationaux, automatiser certaines fonctions et am\xc3\xa9liorer la gestion de leurs activit\xc3\xa9s, ind\xc3\xa9pendamment des barri\xc3\xa8res linguistiques ou du niveau de formation. \xc2\xab gr\xc3\xa2ce \xc3\xa0 l\xe2\x80\x99intelligence artificielle, une femme entrepreneure peut aujourd\xe2\x80\x99hui vendre \xc3\xa0 l\xe2\x80\x99international, automatiser son service client et mieux g\xc3\xa9rer son activit\xc3\xa9. la digitalisation n\xe2\x80\x99est plus un luxe, mais une n\xc3\xa9cessit\xc3\xa9 \xc2\xbb, a-t-elle soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>toutefois, cette transition technologique ne peut \xc3\xaatre pleinement effective sans un accompagnement financier adapt\xc3\xa9. l\xe2\x80\x99experte a rappel\xc3\xa9 que la transformation num\xc3\xa9rique d\xe2\x80\x99une entreprise requiert g\xc3\xa9n\xc3\xa9ralement des investissements estim\xc3\xa9s entre 500 000 et 2 millions de francs cfa, appelant ainsi les institutions financi\xc3\xa8res \xc3\xa0 int\xc3\xa9grer davantage les crit\xc3\xa8res digitaux dans l\xe2\x80\x99analyse des projets entrepreneuriaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des consid\xc3\xa9rations techniques et \xc3\xa9conomiques, cette conf\xc3\xa9rence a surtout mis en lumi\xc3\xa8re la place strat\xc3\xa9gique des femmes dans le tissu \xc3\xa9conomique togolais, ainsi que l\xe2\x80\x99urgence de leur fournir des outils adapt\xc3\xa9s pour \xc3\xa9voluer dans un univers de plus en plus num\xc3\xa9ris\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":877,\"width\":\"741px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/img-20260616-wa0305-450x338-1.jpg\" alt=\"\" class=\"wp-image-877\" style=\"width:741px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les c\xc3\xa9l\xc3\xa9brations du jubil\xc3\xa9 d\xe2\x80\x99argent de l\xe2\x80\x99afcet se poursuivront avec une soir\xc3\xa9e de gala pr\xc3\xa9vue samedi prochain. au programme, des distinctions honorifiques seront d\xc3\xa9cern\xc3\xa9es aux anciennes pr\xc3\xa9sidentes de l\xe2\x80\x99association et \xc3\xa0 plusieurs femmes ayant contribu\xc3\xa9 \xc3\xa0 son rayonnement depuis un quart de si\xc3\xa8cle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, apr\xc3\xa8s 25 ans d\xe2\x80\x99existence, l\xe2\x80\x99afcet ouvre r\xc3\xa9solument un nouveau chapitre, plac\xc3\xa9 sous le signe de l\xe2\x80\x99innovation, de la formation et de la transformation digitale au service de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin togolais.</p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.21.34.0
country_id: 6252001
description:
Jun 17 09:03:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.21.34.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.34.0
country_id: 6252001
description:
2026-06-17 09:03:10 dovecot_plain authenticator failed for H=c-73-21-34-0.hsd1.ga.comcast.net (t1tbg4iimseo1e8taa) [73.21.34.0]:49195: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.224.99.1
country_id: 2017370
description:
[2026-06-17 09:03:57 +0000] info [whostmgrd] 91.224.99.1 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.250.166.250
country_id: 2017370
description:
[2026-06-17 09:04:09 +0000] info [cpaneld] 89.250.166.250 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.86.104.6
country_id: 3625428
description:
[2026-06-17 09:04:12 +0000] info [cpaneld] 82.86.104.6 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.33.112
country_id: 3895114
description:
[2026-06-17 09:04:17 +0000] info [cpaneld] 190.5.33.112 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.79.164.152
country_id: 3895114
description:
[2026-06-17 09:04:20 +0000] info [cpaneld] 186.79.164.152 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.148.130.67
country_id: 3865483
description:
[2026-06-17 09:03:53 +0000] info [cpaneld] 186.148.130.67 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.250.148.54
country_id: 6254930
description:
[2026-06-17 09:04:01 +0000] info [cpaneld] 199.250.148.54 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.0
country_id: 690791
description:
Jun 17 09:04:42 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.0 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.140.25.122
country_id: 1522867
description:
[2026-06-17 09:04:23 +0000] info [cpaneld] 45.140.25.122 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.94.230.79
country_id: 3469034
description:
[2026-06-17 09:04:28 +0000] info [cpaneld] 138.94.230.79 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.7.12.78
country_id: 1522867
description:
2026-06-17 09:05:57 H=([195.7.12.78]) [195.7.12.78]:57323 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 134.195.83.86
country_id: 6252001
domain: nps.tg
description:
IM360 WAF: Hidden file access||RSV:8.18||T:APACHE||QS:to=bobilopaol@universitasnasional506.onmicrosoft.com||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-17 09:06:58 +0000] info [cpaneld] 107.175.5.43 NEW vejjghdd:QEPrPmEvCZ6FybSj address=107.175.5.43,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-17 09:06:53 +0000] info [cpaneld] 5.175.229.192 NEW qfaclpeg:iZ1cs8a_IRgBy6Mx address=5.175.229.192,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-17 09:06:52 +0000] info [cpaneld] 5.230.133.135 NEW sahamtg:zttMGdIMsU0UiriC address=5.230.133.135,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-17 09:06:58 +0000] info [cpaneld] 45.61.130.187 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-17 09:06:58 +0000] info [cpaneld] 5.230.153.108 NEW newistm:mCfdUoPC8B9UpzNd address=5.230.153.108,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.136.130.100
country_id: 1733045
description:
175.136.130.100 - - [17/Jun/2026:09:08:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368090&pdata=https%253A%252F%252Feducplusmedia.tg%252Fpage%252F38%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687284 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/page/38/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5407.1663 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.136.130.100


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:08:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382957&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687313 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:08:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884845&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687315 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:09:09:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7037288&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687390 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:09:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315888&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687390 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:09:10:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197353&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687397 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:09:10:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13354950&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687410 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.98.1.121
country_id: 1562822
description:
116.98.1.121 - - [17/Jun/2026:09:10:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868955&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffdr-2020-2025-419-milliards-de-francs-pour-dynamiser-la-creation-demplois%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687410 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/fdr-2020-2025-419-milliards-de-francs-pour-dynamiser-la-creation-demplois/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2639.1550 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.98.1.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.162.130.28
country_id: 6252001
description:
2026-06-17 09:10:54 dovecot_plain authenticator failed for H=(n919f5prv9zi86nq1ij02) [75.162.130.28]:53851: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.162.130.28
country_id: 6252001
description:
Jun 17 09:10:52 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.162.130.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:12:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:12:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:12:03 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:12:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.102.78.254
country_id: 2661886
description:
Jun 17 09:12:31 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.102.78.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.113.30
country_id: 1269750
description:
Jun 17 09:12:44 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.113.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.102.78.254
country_id: 2661886
description:
2026-06-17 09:12:33 dovecot_login authenticator failed for H=c213-102-78-254.bredband.tele2.se ([178.46.161.220]) [213.102.78.254]:59720: 535 Incorrect authentication data (set_id=utbsdg@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.30
country_id: 1269750
description:
2026-06-17 09:12:46 dovecot_login authenticator failed for H=([95.37.99.231]) [27.123.113.30]:36742: 535 Incorrect authentication data (set_id=utbsdg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.199.110.222
country_id: 1210997
description:
103.199.110.222 - - [17/Jun/2026:09:16:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119882&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-chefs-dentreprises-francais-misent-au-parfum-des-opportunites-daffaires-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687766 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-chefs-dentreprises-francais-misent-au-parfum-des-opportunites-daffaires-au-togo/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.2998.1711 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.199.110.222


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-17 09:16:13 +0000] info [cpaneld] 185.213.83.245 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
country_id: 1269750
description:
Jun 17 09:15:33 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-06-17 09:15:35 dovecot_login authenticator failed for H=(kd113158205225.ppp-bb.dion.ne.jp) [182.76.71.82]:40006: 535 Incorrect authentication data (set_id=hr@cameg-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 09:15:56 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:53584: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-06-17 09:16:09 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th (clients41-krd-155.freedom1.ru) [171.100.121.127]:41374: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.121.127
country_id: 1605651
description:
Jun 17 09:16:07 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.121.127 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.98.245.223
country_id: 1562822
description:
116.98.245.223 - - [17/Jun/2026:09:16:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737578&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpaix-securite-developpement-concertations-au-sommet%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781687796 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/paix-securite-developpement-concertations-au-sommet/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.2320.1471 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.98.245.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.25
country_id: 298795
description:
Jun 17 09:18:36 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
country_id: 1269750
description:
Jun 17 09:19:32 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.52.52.162
country_id: 3469034
description:
2026-06-17 09:19:33 dovecot_login authenticator failed for H=([220.180.249.165]) [189.52.52.162]:58622: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-06-17 09:19:34 dovecot_login authenticator failed for H=(kd113158205225.ppp-bb.dion.ne.jp) [182.76.71.82]:58256: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2026-06-17 09:19:40 dovecot_login authenticator failed for H=(88.248.250.143.static.ttnet.com.tr) [27.123.111.114]:40796: 535 Incorrect authentication data (set_id=webmaster@cameg-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.6.66
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/aaabb5 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.111.114
country_id: 1269750
description:
Jun 17 09:19:38 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.111.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.132
country_id: 1668284
description:
Jun 17 09:22:06 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-06-17 09:22:08 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net ([182.95.215.123]) [111.70.29.132]:57073: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:21:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210782&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688093 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:21:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000019&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688092 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:09:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9948053&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688314 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:25:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180950&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688316 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:09:25:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052142&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688320 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:09:25:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526610&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688325 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 173.239.196.178
country_id: 1227603
domain: biom.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.18||T:APACHE||SC:/home/ulduzncs/public_html/biom.tensai.tg/public/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-17 09:25:23 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:26:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:09:27:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121315&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWFqZWQuYWxzdWJpZUBhcmFtY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688424 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWFqZWQuYWxzdWJpZUBhcmFtY28uY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:26:29 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:26:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:26:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 173.239.196.178
country_id: 1227603
domain: biom.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350559
name: IM360 WAF: Interaction with fake plugin
abuser: 173.239.196.176
country_id: 1227603
domain: biom.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/easy-themes-manager/||WPU:||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.95
country_id: 798544
description:
Jun 17 09:27:48 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.40.5.94
country_id: 2921044
description:
Jun 17 09:28:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.40.5.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.40.5.94
country_id: 2921044
description:
2026-06-17 09:28:49 dovecot_plain authenticator failed for H=(6n9xwm0n4iwd0tzu8prbg) [191.40.5.94]:48962: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.150
country_id: 933860
description:
Jun 17 09:29:36 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.74
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-30.148.222.185.74||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-17 09:31:40 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:45822: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.72.179.185
country_id: 1527747
description:
2026-06-17 09:31:58 H=([80.72.179.185]) [80.72.179.185]:59672 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.244.58.152
country_id: 3865483
description:
[2026-06-17 09:31:59 +0000] info [cpaneld] 170.244.58.152 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.57.96.57
country_id: 3865483
description:
[2026-06-17 09:31:31 +0000] info [cpaneld] 186.57.96.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.85.68
country_id: 3895114
description:
[2026-06-17 09:31:41 +0000] info [cpaneld] 186.189.85.68 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [17/Jun/2026:09:32:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724756&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688721 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.33.247.46
country_id: 2077456
description:
Jun 17 09:33:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.33.247.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-06-17 09:33:15 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au ([220.72.138.160]) [27.33.247.46]:58015: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.157.63.224
country_id: 2077456
description:
Jun 17 09:33:03 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.157.63.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.63.224
country_id: 2077456
description:
2026-06-17 09:33:05 dovecot_login authenticator failed for H=([82.39.109.201]) [120.157.63.224]:41358: 535 Incorrect authentication data (set_id=inf@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.199.60.176
country_id: 1880251
description:
138.199.60.176 - - [17/Jun/2026:09:33:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461032&pdata=https%253A%252F%252Ffomda.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781688838 HTTP/2.0" 302 0 fomda.tg "https://fomda.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.199.60.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-06-17 09:34:01 dovecot_login authenticator failed for H=(clients41-krd-155.freedom1.ru) [103.206.131.33]:57679: 535 Incorrect authentication data (set_id=no-reply@cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.60.176
country_id: 1880251
description:
[2026-06-17 09:34:10 +0000] info [cpaneld] 138.199.60.176 - tgkkwsvr  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 138.199.60.176
country_id: 1880251
description:
[2026-06-17 09:34:13 +0000] info [cpaneld] 138.199.60.176 NEW tgkkwsvr:pXbBxaqzRo4UBrmr address=138.199.60.176,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-06-17 09:35:21 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([213.230.65.53]) [171.100.121.127]:50480: 535 Incorrect authentication data (set_id=webmaster@cameg-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.154.233.162
country_id: 2287781
description:
2026-06-17 09:34:27 H=([160.154.233.162]) [160.154.233.162]:49222 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.121.127
country_id: 1605651
description:
Jun 17 09:35:19 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.121.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.211.165.46
country_id: 2077456
description:
Jun 17 09:35:37 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.211.165.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.246.97
country_id: 2017370
description:
2026-06-17 09:36:00 dovecot_login authenticator failed for H=([117.213.181.6]) [31.207.246.97]:56012: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-06-17 09:35:39 dovecot_login authenticator failed for H=([70.168.6.165]) [118.211.165.46]:51608: 535 Incorrect authentication data (set_id=arts@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.224.207.160
country_id: 163843
description:
[2026-06-17 09:36:08 +0000] info [cpaneld] 129.224.207.160 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.187.135.206
country_id: 3865483
description:
[2026-06-17 09:36:11 +0000] info [cpaneld] 45.187.135.206 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.94.35.222
country_id: 2017370
description:
[2026-06-17 09:35:54 +0000] info [cpaneld] 188.94.35.222 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.74
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-35.148.222.185.74||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.15.200
country_id: 3865483
description:
[2026-06-17 09:35:57 +0000] info [cpaneld] 153.67.15.200 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.246.97
country_id: 2017370
description:
Jun 17 09:35:58 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.246.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.192.222
country_id: 3996063
description:
[2026-06-17 09:36:03 +0000] info [cpaneld] 187.190.192.222 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.53.103.95
country_id: 3017382
description:
[2026-06-17 09:36:06 +0000] info [cpaneld] 81.53.103.95 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:37:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196884&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689030 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:37:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949345&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689030 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.66.162.185
country_id: 2361809
description:
154.66.162.185 - - [17/Jun/2026:09:37:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7456456&pdata=https%253A%252F%252Ftdn.tg%252Funiversite-joseph-ki-zerbo-master-sante-publique-ufr-sds%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689041 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/universite-joseph-ki-zerbo-master-sante-publique-ufr-sds/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.66.162.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:09:38:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128008&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689079 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:09:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13159573&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689132 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:09:38:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119059&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689136 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:39:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450838&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689136 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13377,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-16-at-03.39.33.jpeg\" alt=\"\" class=\"wp-image-13377\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><em>dans la commune des lacs 1, les examens du certificat d\xe2\x80\x99\xc3\xa9tudes du premier degr\xc3\xa9 (cepd) et du baccalaur\xc3\xa9at deuxi\xc3\xa8me partie (bac 2)\xc2\xa0ont officiellement d\xc3\xa9marr\xc3\xa9 le mardi 16 juin dans les diff\xc3\xa9rents centres d\xe2\x80\x99\xc3\xa9crit. les autorit\xc3\xa9s locales et \xc3\xa9ducatives ont effectu\xc3\xa9 le tour de quelques centres pour constater l\xe2\x80\x99effectivit\xc3\xa9 de ces deux examens et encourager les candidats.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la d\xc3\xa9l\xc3\xa9gation conduite par le pr\xc3\xa9fet des lacs, mr dat\xc3\xa9 benissan-t\xc3\x8at\xc3\x8avi et le maire adjoint de la commune des lacs 1, mr kangni agossou kouevi a visit\xc3\xa9 tout d\xe2\x80\x99abord le lyc\xc3\xa9e z\xc3\xa9b\xc3\xa9vi, seul centre d\xe2\x80\x99\xc3\xa9crit pour l\xe2\x80\x99examen du bac 2 dans la commune. ensuite, les membres de la d\xc3\xa9l\xc3\xa9gation se sont rendus \xc3\xa0 l\xe2\x80\x99\xc3\xa9cole catholique de glidji o\xc3\xb9 les \xc3\xa9l\xc3\xa8ves composent pour le cepd. l'objectif de la tourn\xc3\xa9e est de s\xe2\x80\x99assurer du bon d\xc3\xa9roulement des \xc3\xa9preuves et renforcer la confiance des candidats d\xc3\xa8s les premi\xc3\xa8res heures du d\xc3\xa9but des examens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans ces deux centres, les autorit\xc3\xa9s locales ont invit\xc3\xa9 les candidats \xc3\xa0 garder leur calme, \xc3\xa0 avoir confiance en eux-m\xc3\xaames, \xc3\xa0 lire attentivement les sujets, \xc3\xa0 bien r\xc3\xa9fl\xc3\xa9chir avant de r\xc3\xa9pondre aux questions et \xc3\xa0 veiller \xc3\xa0 inscrire correctement leurs num\xc3\xa9ros de table sur les copies. les officiels ont, au nom du gouvernement et des parents d\xe2\x80\x99\xc3\xa9l\xc3\xa8ves, souhait\xc3\xa9 bonne chance aux candidats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":13378,\"width\":\"757px\",\"height\":\"auto\",\"aspectratio\":\"32.46014735432016\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-16-at-03.39.33-1-1.jpeg\" alt=\"\" class=\"wp-image-13378\" style=\"aspect-ratio:32.46014735432016;width:757px;height:auto\"/><figcaption class=\"wp-element-caption\"><strong>le maire adjoint, mr kangni agossou kouevi (en noir) prodiguant quelques conseils aux \xc3\xa9l\xc3\xa8ves en qu\xc3\xaate du cepd avant le lancement des \xc3\xa9preuves</strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les responsables des diff\xc3\xa9rents centres ont rassur\xc3\xa9 de leur c\xc3\xb4t\xc3\xa9 que toutes les dispositions sont mises en place pour que ces examens se d\xc3\xa9roulent dans de bonnes conditions. ils n\xe2\x80\x99ont signal\xc3\xa9 aucun incident majeur. pour rappel, l\xe2\x80\x99examen du cepd sanctionne la fin des \xc3\xa9tudes au cours primaire et ouvre la voix au coll\xc3\xa8ge tandis que le bac 2 est le premier dipl\xc3\xb4me universitaire qui donne acc\xc3\xa8s aux \xc3\xa9tudes sup\xc3\xa9rieures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les \xc3\xa9preuves du cepd s\xe2\x80\x99ach\xc3\xa8veront le 18 juin, et celles du bac 2, le 20 juin.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>contact : communication@lacs1.mairie.tg/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:39:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:39:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:39:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.227.186
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/92.jpeg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.33.25.26
country_id: 2510769
description:
83.33.25.26 - - [17/Jun/2026:09:39:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538948&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-119377zetidm40lez.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689167 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-119377zetidm40lez.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.33.25.26


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-17 09:40:27 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53051: 535 Incorrect authentication data (set_id=test1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 17 09:40:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-06-17 09:41:49 dovecot_login authenticator failed for H=([182.95.171.107]) [182.95.189.66]:41692: 535 Incorrect authentication data (set_id=it@anrtogo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.128.151
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/16.jpeg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.104.70.143
country_id: 2017370
description:
2026-06-17 09:41:54 dovecot_login authenticator failed for H=([75.232.135.89]) [212.104.70.143]:55298: 535 Incorrect authentication data (set_id=malidis@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.99.110.229
country_id: 690791
description:
2026-06-17 09:42:04 dovecot_login authenticator failed for H=([41.60.178.36]) [176.99.110.229]:52272: 535 Incorrect authentication data (set_id=malidis)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-06-17 09:42:10 dovecot_login authenticator failed for H=(188x234x242x48.static-business.ekat.ertelecom.ru) [189.56.0.19]:60386: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.99.110.229
country_id: 690791
description:
Jun 17 09:42:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.99.110.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.4.239
country_id: 6252001
description:
2026-06-17 09:43:51 dovecot_plain authenticator failed for H=c-76-106-4-239.hsd1.md.comcast.net (e3c2smxx3267qjoudq) [76.106.4.239]:44329: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.227.82.22
country_id: 3469034
description:
Jun 17 09:45:19 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.227.82.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.82.22
country_id: 3469034
description:
2026-06-17 09:45:21 dovecot_login authenticator failed for H=([111.70.34.159]) [186.227.82.22]:60095: 535 Incorrect authentication data (set_id=senadake@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.122.215
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/PIA-Parking-a-camion-768x393.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/PIA-Parking-a-camion-768x393-300x154.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.75.139.138
country_id: 1861060
description:
2026-06-17 09:45:32 dovecot_login authenticator failed for H=219-75-139-138f2.kns1.eonet.ne.jp ([180.149.232.33]) [219.75.139.138]:61725: 535 Incorrect authentication data (set_id=senadake)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 09:47:22 +0000] info [cpaneld] 157.85.64.85 - 20834968961470 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 09:48:13 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:50032: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.164.212.229
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/Plateforme-industrielle-dAdetikope-le-parking-a-camion-et-le-port-sec-deja-operationnels-768x432.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/Plateforme-industrielle-dAdetikope-le-parking-a-camion-et-le-port-sec-deja-operationnels-768x432-300x169.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.110.44.208
country_id: 6252001
description:
2026-06-17 09:47:33 dovecot_plain authenticator failed for H=(wntihwicm072fkt9xqapvhd8bc) [174.110.44.208]:36602: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.238.69
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/73.jpeg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.185.72.145
country_id: 163843
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/referencement-ckool HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 09:49:22 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:49990: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.89.57
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/jeu-capsules-consommateurs-remise-lots-1 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.93.171
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-djama-stout-porter HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 09:50:14 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:62370: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 195.96.143.190
country_id: 690791
description:
195.96.143.190 - - [17/Jun/2026:09:49:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922713&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-recrutement-unites-soins-peripheriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689760 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-recrutement-unites-soins-peripheriques/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.6123.999 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:195.96.143.190


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.227.60
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/Developpement-Echanges-entre-le-chef-de-lEtat-et-le-president-du-Groupe-de-la-BAD.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2024/02/Developpement-Echanges-entre-le-chef-de-lEtat-et-le-president-du-Groupe-de-la-BAD-300x250.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/Developpement-Echanges-entre-le-chef-de-lEtat-et-le-president-du-Groupe-de-la-BAD-768x639.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:51:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738598&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689889 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.159.98
country_id: 1733045
description:
161.142.159.98 - - [17/Jun/2026:09:52:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209686&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14480&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689922 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14480" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.6300.1870 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.159.98


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:51:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015402&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781689889 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 09:51:58 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:61678: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.227.28
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/7||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.226
country_id: 2635167
description:
[2026-06-17 09:53:31 +0000] info [cpaneld] 5.230.153.226 NEW wwayrzpl:oYEjKnvzD5ekZzQV address=5.230.153.226,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 09:54:07 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:54118: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:54:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:09:54:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7434695&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690052 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.144.90
country_id: 1522867
description:
2026-06-17 09:53:24 H=([0.0.0.0]) [89.218.144.90]:53929 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:09:54:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:54:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:54:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:09:54:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314583&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690053 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:09:54:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066540&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690061 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:09:54:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063497&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690064 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 09:54:48 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:47774: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.242.208.190
country_id: 1522867
description:
2026-06-17 09:54:50 H=([80.242.208.190]) [80.242.208.190]:51970 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.70.75.89
country_id: 2921044
description:
[2026-06-17 09:57:14 +0000] info [cpaneld] 31.70.75.89 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 09:58:25 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:55901: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 10:00:04 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:46832: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-17 10:00:10 +0000] info [cpaneld] 5.230.133.89 NEW wcnyaruu:iMtTTx1YmbnYLbDn address=5.230.133.89,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.78.118.46
country_id: 2017370
description:
Jun 17 10:00:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.78.118.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.78.118.46
country_id: 2017370
description:
2026-06-17 10:00:26 dovecot_plain authenticator failed for H=(713i0w9omfm327o2ujwej) [95.78.118.46]:64020: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 92.62.121.212
country_id: 1269750
description:
[2026-06-17 10:03:05 +0000] info [cpaneld] 92.62.121.212 NEW tgkkwsvr:lTY2s2FuHPHlMmHa address=92.62.121.212,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.105.144
country_id: 3865483
description:
Jun 17 10:02:29 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.105.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 10:02:31 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:43202: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 10:04:09 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:63145: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 156.38.84.59
country_id: 2363686
description:
[2026-06-17 10:03:59 +0000] info [cpaneld] 156.38.84.59 NEW zephyradmin:cMp0V3PJYLrTav1w address=156.38.84.59,app=cpaneld,creator=zephyradmin,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.218.59.26
country_id: 1522867
description:
2026-06-17 10:05:16 H=([89.218.59.26]) [89.218.59.26]:22699 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:04:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001066&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690661 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:04:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197350&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690664 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 10:05:11 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:53577: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.70.75.89
country_id: 2921044
description:
[2026-06-17 10:05:25 +0000] info [cpaneld] 31.70.75.89 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:05:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:05:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:10:05:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869929&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690756 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:05:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:05:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 10:06:10 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:61114: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.205.171
country_id: 1668284
description:
2026-06-17 10:06:15 dovecot_plain authenticator failed for H=(sy06wmap0ib3cvgihw9fd9p5) [94.156.205.171]:1182: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/17/2026:10:06:54 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 10:07:19 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:61124: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:10:08:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012518&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690887 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:10:08:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7497839&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690899 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.95
country_id: 798544
description:
Jun 17 10:08:52 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 180.222.140.205
country_id: 1149361
description:
2026-06-17 10:09:12 H=([180.222.140.205]) [180.222.140.205]:56450 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:10:08:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065764&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690903 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 10:08:55 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:54550: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:08:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869466&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781690902 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.108.24
country_id: 3469034
description:
Jun 17 10:09:12 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.108.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.59.219
country_id: 2245662
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/village-djama-evala-2023 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.251.47.50
country_id: 2921044
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/reunion-distributeurs HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.108.24
country_id: 3469034
description:
Jun 17 10:09:26 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.108.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 17 10:09:43 ns5 pure-ftpd[1827289]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.245.99.57
country_id: 1522867
description:
2026-06-17 10:09:56 H=([77.245.99.57]) [77.245.99.57]:57904 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.242.102.138
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/8.jpeg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 10:09:28 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:58606: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-17 10:10:51 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:62911: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-17 10:11:56 +0000] info [cpaneld] 45.61.130.187 - sodigaz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.38.84.208
country_id: 2363686
description:
[2026-06-17 10:12:07 +0000] info [webmaild] 156.38.84.208 - rtchayiza@pnls.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.38.84.208
country_id: 2363686
description:
[2026-06-17 10:13:24 +0000] info [webmaild] 156.38.84.208 - rtchayiza@pnls.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.132.74
country_id: 1269750
description:
2026-06-17 10:16:05 dovecot_login authenticator failed for H=(103.59.132.74) [103.59.132.74]:37522: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.70.75.89
country_id: 2921044
description:
[2026-06-17 10:15:41 +0000] info [cpaneld] 31.70.75.89 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:10:19:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804389&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781691546 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.79.128.161
country_id: 2802361
domain: autodiscover.sproca.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.18||T:APACHE||REQUEST_URI:/autodiscover/autodiscover.xml/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.19
country_id: 6252001
description:
[2026-06-17 10:20:20 +0000] info [cpaneld] 64.44.59.19 NEW qfaclpeg:LCYnBcHsgn4e3Jv5 address=64.44.59.19,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.14
country_id: 2635167
description:
[2026-06-17 10:20:23 +0000] info [cpaneld] 5.230.133.14 NEW wcnyaruu:7mQ7HkgPaRRQo8t6 address=5.230.133.14,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:21:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131142&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781691659 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 10:20:50 +0000] info [cpaneld] 157.85.64.85 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:21:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987177&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781691658 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.18.127.112
country_id: 6252001
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:212.18.127.112||TA:212.18.127.112||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:22:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:22:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:10:23:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014430&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781691787 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:22:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:10:23:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249621&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781691786 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:22:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:23:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662063&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781691786 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:10:23:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841797&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781691792 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.38.84.208
country_id: 2363686
description:
[2026-06-17 10:24:04 +0000] info [webmaild] 156.38.84.208 - rtchayiza@pnls.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.249.46
country_id: 1269750
description:
Jun 17 10:24:20 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.249.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.249.46
country_id: 1269750
description:
2026-06-17 10:24:22 dovecot_login authenticator failed for H=([72.207.113.126]) [128.185.249.46]:50880: 535 Incorrect authentication data (set_id=no-reply@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.219
country_id: 1269750
description:
Jun 17 10:25:03 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.161.38
country_id: 2017370
description:
2026-06-17 10:26:07 dovecot_plain authenticator failed for H=(r7jgew7qvghqzp19yovyonfm3vjmqcq6) [104.28.161.38]:43666: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:10:27:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050858&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692018 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:10:27:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13224604&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWlkYXdvdWRAYmFua2FsamF6aXJhLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692038 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWlkYXdvdWRAYmFua2FsamF6aXJhLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.23.210.190
country_id: 6252001
description:
Jun 17 10:26:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.23.210.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.23.210.190
country_id: 6252001
description:
2026-06-17 10:26:26 dovecot_plain authenticator failed for H=(5zlh2dg0l7a9tyoohc9r7df2iwsq15zj) [70.23.210.190]:53140: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [17/Jun/2026:10:28:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13331559&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWlkYXdvdWRAYmFua2FsamF6aXJhLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692086 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWlkYXdvdWRAYmFua2FsamF6aXJhLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.141
country_id: 3865483
description:
Jun 17 10:28:49 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.38.84.208
country_id: 2363686
description:
[2026-06-17 10:31:32 +0000] info [webmaild] 156.38.84.208 - rtchayiza@pnls.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-17 10:32:27 +0000] info [cpaneld] 5.230.153.156 NEW wcnyaruu:KNAifYtZVQD0AT8A address=5.230.153.156,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jun 17 10:34:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.178
country_id: 3469034
description:
Jun 17 10:34:22 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:34:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7498395&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692484 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:34:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183512&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692486 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.194.51
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:736-de-taux-dexecution-physique-a-fin-decembre-2023/||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.19.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong>dans un monde \xc3\xa9conomique en mutation rapide o\xc3\xb9 le digital redessine les r\xc3\xa8gles du jeu entrepreneurial, l\xe2\x80\x99association des femmes cheffes d\xe2\x80\x99entreprise du togo (afcet) a marqu\xc3\xa9 une halte strat\xc3\xa9gique. le 16 juin 2026, elle a c\xc3\xa9l\xc3\xa9br\xc3\xa9 son 25e anniversaire \xc3\xa0 travers une conf\xc3\xa9rence-d\xc3\xa9bat d\xe2\x80\x99envergure autour d\xe2\x80\x99un th\xc3\xa8me central : \xc2\xab les entreprises f\xc3\xa9minines \xc3\xa0 l\xe2\x80\x99\xc3\xa8re du num\xc3\xa9rique et du digital \xc2\xbb. une rencontre dense, rassemblant entrepreneures, expertes du num\xc3\xa9rique, responsables institutionnels et partenaires techniques, tous r\xc3\xa9unis pour interroger l\xe2\x80\x99avenir des entreprises dirig\xc3\xa9es par des femmes face aux d\xc3\xa9fis de la transformation digitale.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des \xc3\xa9changes, une pr\xc3\xa9occupation majeure s\xe2\x80\x99est impos\xc3\xa9e : comment renforcer la comp\xc3\xa9titivit\xc3\xa9 des entreprises f\xc3\xa9minines dans un environnement o\xc3\xb9 la ma\xc3\xaetrise des outils num\xc3\xa9riques devient un levier d\xc3\xa9cisif de survie et de croissance. pendant plusieurs heures de discussions, les participantes ont explor\xc3\xa9 les voies possibles d\xe2\x80\x99une adaptation efficace \xc3\xa0 cette nouvelle donne \xc3\xa9conomique mondiale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lire l'article : <a>cybers\xc3\xa9curit\xc3\xa9 au togo : l\xe2\x80\x99ancy outille les m\xc3\xa9dias \xc3\xa0 kpalim\xc3\xa9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://leadelles.tg/index.php/author/carole/\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour la pr\xc3\xa9sidente de l\xe2\x80\x99afcet, annie gon\xc3\xa7alves gbado\xc3\xa8, ce jubil\xc3\xa9 d\xe2\x80\x99argent d\xc3\xa9passe le simple cadre comm\xc3\xa9moratif. il s\xe2\x80\x99agit plut\xc3\xb4t d\xe2\x80\x99un tournant strat\xc3\xa9gique pour l\xe2\x80\x99organisation, appel\xc3\xa9e \xc3\xa0 se r\xc3\xa9inventer. \xc2\xab vingt-cinq ans, c\xe2\x80\x99est beaucoup et c\xe2\x80\x99est peu \xc3\xa0 la fois dans la vie d\xe2\x80\x99une organisation. cette conf\xc3\xa9rence doit susciter un nouvel \xc3\xa9lan aupr\xc3\xa8s des femmes entrepreneures et les encourager \xc3\xa0 s\xe2\x80\x99approprier davantage les outils du num\xc3\xa9rique \xc2\xbb, a-t-elle indiqu\xc3\xa9. dans cette dynamique, elle a annonc\xc3\xa9 une s\xc3\xa9rie d\xe2\x80\x99initiatives futures, notamment des s\xc3\xa9minaires, des ateliers de sensibilisation et des actions de proximit\xc3\xa9 destin\xc3\xa9es \xc3\xa0 renforcer les capacit\xc3\xa9s des femmes, en particulier celles des zones rurales, tout en \xc3\xa9largissant l\xe2\x80\x99implantation de l\xe2\x80\x99association \xc3\xa0 l\xe2\x80\x99int\xc3\xa9rieur du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>replac\xc3\xa9e au centre des d\xc3\xa9bats, la notion m\xc3\xaame de transformation digitale a fait l\xe2\x80\x99objet d\xe2\x80\x99un \xc3\xa9clairage approfondi. une distinction essentielle a \xc3\xa9t\xc3\xa9 apport\xc3\xa9e par m\xc3\xa9dissa sama, pr\xc3\xa9sidente de la conf\xc3\xa9d\xc3\xa9ration des jeunes entreprises et start-up du togo et pan\xc3\xa9liste. selon elle, l\xe2\x80\x99usage d\xe2\x80\x99outils num\xc3\xa9riques ne saurait \xc3\xaatre confondu avec une v\xc3\xa9ritable digitalisation de l\xe2\x80\x99entreprise. elle tranche avec clart\xc3\xa9 : \xc2\xab utiliser des outils num\xc3\xa9riques n\xe2\x80\x99est pas digitaliser son entreprise. la digitalisation consiste \xc3\xa0 repenser l\xe2\x80\x99organisation de l\xe2\x80\x99entreprise, \xc3\xa0 connecter les informations, les processus et les services pour gagner en efficacit\xc3\xa9 et en comp\xc3\xa9titivit\xc3\xa9 \xc2\xbb, a-t-elle expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans un contexte marqu\xc3\xa9 par l\xe2\x80\x99essor fulgurant de l\xe2\x80\x99intelligence artificielle, elle estime que de nouvelles opportunit\xc3\xa9s s\xe2\x80\x99ouvrent aux entrepreneures africaines. celles-ci peuvent d\xc3\xa9sormais acc\xc3\xa9der \xc3\xa0 des march\xc3\xa9s internationaux, automatiser certaines fonctions et am\xc3\xa9liorer la gestion de leurs activit\xc3\xa9s, ind\xc3\xa9pendamment des barri\xc3\xa8res linguistiques ou du niveau de formation. \xc2\xab gr\xc3\xa2ce \xc3\xa0 l\xe2\x80\x99intelligence artificielle, une femme entrepreneure peut aujourd\xe2\x80\x99hui vendre \xc3\xa0 l\xe2\x80\x99international, automatiser son service client et mieux g\xc3\xa9rer son activit\xc3\xa9. la digitalisation n\xe2\x80\x99est plus un luxe, mais une n\xc3\xa9cessit\xc3\xa9 \xc2\xbb, a-t-elle soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>toutefois, cette transition technologique ne peut \xc3\xaatre pleinement effective sans un accompagnement financier adapt\xc3\xa9. l\xe2\x80\x99experte a rappel\xc3\xa9 que la transformation num\xc3\xa9rique d\xe2\x80\x99une entreprise requiert g\xc3\xa9n\xc3\xa9ralement des investissements estim\xc3\xa9s entre 500 000 et 2 millions de francs cfa, appelant ainsi les institutions financi\xc3\xa8res \xc3\xa0 int\xc3\xa9grer davantage les crit\xc3\xa8res digitaux dans l\xe2\x80\x99analyse des projets entrepreneuriaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des consid\xc3\xa9rations techniques et \xc3\xa9conomiques, cette conf\xc3\xa9rence a surtout mis en lumi\xc3\xa8re la place strat\xc3\xa9gique des femmes dans le tissu \xc3\xa9conomique togolais, ainsi que l\xe2\x80\x99urgence de leur fournir des outils adapt\xc3\xa9s pour \xc3\xa9voluer dans un univers de plus en plus num\xc3\xa9ris\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":877,\"width\":\"741px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/img-20260616-wa0305-450x338-1.jpg\" alt=\"\" class=\"wp-image-877\" style=\"width:741px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les c\xc3\xa9l\xc3\xa9brations du jubil\xc3\xa9 d\xe2\x80\x99argent de l\xe2\x80\x99afcet se poursuivront avec une soir\xc3\xa9e de gala pr\xc3\xa9vue samedi prochain. au programme, des distinctions honorifiques seront d\xc3\xa9cern\xc3\xa9es aux anciennes pr\xc3\xa9sidentes de l\xe2\x80\x99association et \xc3\xa0 plusieurs femmes ayant contribu\xc3\xa9 \xc3\xa0 son rayonnement depuis un quart de si\xc3\xa8cle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, apr\xc3\xa8s 25 ans d\xe2\x80\x99existence, l\xe2\x80\x99afcet ouvre r\xc3\xa9solument un nouveau chapitre, plac\xc3\xa9 sous le signe de l\xe2\x80\x99innovation, de la formation et de la transformation digitale au service de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin togolais.</p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.19.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong>dans un monde \xc3\xa9conomique en mutation rapide o\xc3\xb9 le digital redessine les r\xc3\xa8gles du jeu entrepreneurial, l\xe2\x80\x99association des femmes cheffes d\xe2\x80\x99entreprise du togo (afcet) a marqu\xc3\xa9 une halte strat\xc3\xa9gique. le 16 juin 2026, elle a c\xc3\xa9l\xc3\xa9br\xc3\xa9 son 25e anniversaire \xc3\xa0 travers une conf\xc3\xa9rence-d\xc3\xa9bat d\xe2\x80\x99envergure autour d\xe2\x80\x99un th\xc3\xa8me central : \xc2\xab les entreprises f\xc3\xa9minines \xc3\xa0 l\xe2\x80\x99\xc3\xa8re du num\xc3\xa9rique et du digital \xc2\xbb. une rencontre dense, rassemblant entrepreneures, expertes du num\xc3\xa9rique, responsables institutionnels et partenaires techniques, tous r\xc3\xa9unis pour interroger l\xe2\x80\x99avenir des entreprises dirig\xc3\xa9es par des femmes face aux d\xc3\xa9fis de la transformation digitale.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des \xc3\xa9changes, une pr\xc3\xa9occupation majeure s\xe2\x80\x99est impos\xc3\xa9e : comment renforcer la comp\xc3\xa9titivit\xc3\xa9 des entreprises f\xc3\xa9minines dans un environnement o\xc3\xb9 la ma\xc3\xaetrise des outils num\xc3\xa9riques devient un levier d\xc3\xa9cisif de survie et de croissance. pendant plusieurs heures de discussions, les participantes ont explor\xc3\xa9 les voies possibles d\xe2\x80\x99une adaptation efficace \xc3\xa0 cette nouvelle donne \xc3\xa9conomique mondiale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lire l'article : <a>cybers\xc3\xa9curit\xc3\xa9 au togo : l\xe2\x80\x99ancy outille les m\xc3\xa9dias \xc3\xa0 kpalim\xc3\xa9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://leadelles.tg/index.php/author/carole/\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour la pr\xc3\xa9sidente de l\xe2\x80\x99afcet, annie gon\xc3\xa7alves gbado\xc3\xa8, ce jubil\xc3\xa9 d\xe2\x80\x99argent d\xc3\xa9passe le simple cadre comm\xc3\xa9moratif. il s\xe2\x80\x99agit plut\xc3\xb4t d\xe2\x80\x99un tournant strat\xc3\xa9gique pour l\xe2\x80\x99organisation, appel\xc3\xa9e \xc3\xa0 se r\xc3\xa9inventer. \xc2\xab vingt-cinq ans, c\xe2\x80\x99est beaucoup et c\xe2\x80\x99est peu \xc3\xa0 la fois dans la vie d\xe2\x80\x99une organisation. cette conf\xc3\xa9rence doit susciter un nouvel \xc3\xa9lan aupr\xc3\xa8s des femmes entrepreneures et les encourager \xc3\xa0 s\xe2\x80\x99approprier davantage les outils du num\xc3\xa9rique \xc2\xbb, a-t-elle indiqu\xc3\xa9. dans cette dynamique, elle a annonc\xc3\xa9 une s\xc3\xa9rie d\xe2\x80\x99initiatives futures, notamment des s\xc3\xa9minaires, des ateliers de sensibilisation et des actions de proximit\xc3\xa9 destin\xc3\xa9es \xc3\xa0 renforcer les capacit\xc3\xa9s des femmes, en particulier celles des zones rurales, tout en \xc3\xa9largissant l\xe2\x80\x99implantation de l\xe2\x80\x99association \xc3\xa0 l\xe2\x80\x99int\xc3\xa9rieur du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>replac\xc3\xa9e au centre des d\xc3\xa9bats, la notion m\xc3\xaame de transformation digitale a fait l\xe2\x80\x99objet d\xe2\x80\x99un \xc3\xa9clairage approfondi. une distinction essentielle a \xc3\xa9t\xc3\xa9 apport\xc3\xa9e par m\xc3\xa9dissa sama, pr\xc3\xa9sidente de la conf\xc3\xa9d\xc3\xa9ration des jeunes entreprises et start-up du togo et pan\xc3\xa9liste. selon elle, l\xe2\x80\x99usage d\xe2\x80\x99outils num\xc3\xa9riques ne saurait \xc3\xaatre confondu avec une v\xc3\xa9ritable digitalisation de l\xe2\x80\x99entreprise. elle tranche avec clart\xc3\xa9 : \xc2\xab utiliser des outils num\xc3\xa9riques n\xe2\x80\x99est pas digitaliser son entreprise. la digitalisation consiste \xc3\xa0 repenser l\xe2\x80\x99organisation de l\xe2\x80\x99entreprise, \xc3\xa0 connecter les informations, les processus et les services pour gagner en efficacit\xc3\xa9 et en comp\xc3\xa9titivit\xc3\xa9 \xc2\xbb, a-t-elle expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans un contexte marqu\xc3\xa9 par l\xe2\x80\x99essor fulgurant de l\xe2\x80\x99intelligence artificielle, elle estime que de nouvelles opportunit\xc3\xa9s s\xe2\x80\x99ouvrent aux entrepreneures africaines. celles-ci peuvent d\xc3\xa9sormais acc\xc3\xa9der \xc3\xa0 des march\xc3\xa9s internationaux, automatiser certaines fonctions et am\xc3\xa9liorer la gestion de leurs activit\xc3\xa9s, ind\xc3\xa9pendamment des barri\xc3\xa8res linguistiques ou du niveau de formation. \xc2\xab gr\xc3\xa2ce \xc3\xa0 l\xe2\x80\x99intelligence artificielle, une femme entrepreneure peut aujourd\xe2\x80\x99hui vendre \xc3\xa0 l\xe2\x80\x99international, automatiser son service client et mieux g\xc3\xa9rer son activit\xc3\xa9. la digitalisation n\xe2\x80\x99est plus un luxe, mais une n\xc3\xa9cessit\xc3\xa9 \xc2\xbb, a-t-elle soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>toutefois, cette transition technologique ne peut \xc3\xaatre pleinement effective sans un accompagnement financier adapt\xc3\xa9. l\xe2\x80\x99experte a rappel\xc3\xa9 que la transformation num\xc3\xa9rique d\xe2\x80\x99une entreprise requiert g\xc3\xa9n\xc3\xa9ralement des investissements estim\xc3\xa9s entre 500 000 et 2 millions de francs cfa, appelant ainsi les institutions financi\xc3\xa8res \xc3\xa0 int\xc3\xa9grer davantage les crit\xc3\xa8res digitaux dans l\xe2\x80\x99analyse des projets entrepreneuriaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des consid\xc3\xa9rations techniques et \xc3\xa9conomiques, cette conf\xc3\xa9rence a surtout mis en lumi\xc3\xa8re la place strat\xc3\xa9gique des femmes dans le tissu \xc3\xa9conomique togolais, ainsi que l\xe2\x80\x99urgence de leur fournir des outils adapt\xc3\xa9s pour \xc3\xa9voluer dans un univers de plus en plus num\xc3\xa9ris\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":877,\"width\":\"741px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/img-20260616-wa0305-450x338-1.jpg\" alt=\"\" class=\"wp-image-877\" style=\"width:741px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les c\xc3\xa9l\xc3\xa9brations du jubil\xc3\xa9 d\xe2\x80\x99argent de l\xe2\x80\x99afcet se poursuivront avec une soir\xc3\xa9e de gala pr\xc3\xa9vue samedi prochain. au programme, des distinctions honorifiques seront d\xc3\xa9cern\xc3\xa9es aux anciennes pr\xc3\xa9sidentes de l\xe2\x80\x99association et \xc3\xa0 plusieurs femmes ayant contribu\xc3\xa9 \xc3\xa0 son rayonnement depuis un quart de si\xc3\xa8cle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, apr\xc3\xa8s 25 ans d\xe2\x80\x99existence, l\xe2\x80\x99afcet ouvre r\xc3\xa9solument un nouveau chapitre, plac\xc3\xa9 sous le signe de l\xe2\x80\x99innovation, de la formation et de la transformation digitale au service de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin togolais.</p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.164.117
country_id: 298795
domain: djama.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67045.djama.tg||ServerName:djama.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a83adfb36049cf6fc9dcd9b1931f5fa8dd5f12fb||Title:0xe908fd03||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.19.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong>dans un monde \xc3\xa9conomique en mutation rapide o\xc3\xb9 le digital redessine les r\xc3\xa8gles du jeu entrepreneurial, l\xe2\x80\x99association des femmes cheffes d\xe2\x80\x99entreprise du togo (afcet) a marqu\xc3\xa9 une halte strat\xc3\xa9gique. le 16 juin 2026, elle a c\xc3\xa9l\xc3\xa9br\xc3\xa9 son 25e anniversaire \xc3\xa0 travers une conf\xc3\xa9rence-d\xc3\xa9bat d\xe2\x80\x99envergure autour d\xe2\x80\x99un th\xc3\xa8me central : \xc2\xab les entreprises f\xc3\xa9minines \xc3\xa0 l\xe2\x80\x99\xc3\xa8re du num\xc3\xa9rique et du digital \xc2\xbb. une rencontre dense, rassemblant entrepreneures, expertes du num\xc3\xa9rique, responsables institutionnels et partenaires techniques, tous r\xc3\xa9unis pour interroger l\xe2\x80\x99avenir des entreprises dirig\xc3\xa9es par des femmes face aux d\xc3\xa9fis de la transformation digitale.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des \xc3\xa9changes, une pr\xc3\xa9occupation majeure s\xe2\x80\x99est impos\xc3\xa9e : comment renforcer la comp\xc3\xa9titivit\xc3\xa9 des entreprises f\xc3\xa9minines dans un environnement o\xc3\xb9 la ma\xc3\xaetrise des outils num\xc3\xa9riques devient un levier d\xc3\xa9cisif de survie et de croissance. pendant plusieurs heures de discussions, les participantes ont explor\xc3\xa9 les voies possibles d\xe2\x80\x99une adaptation efficace \xc3\xa0 cette nouvelle donne \xc3\xa9conomique mondiale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lire l'article : <a>cybers\xc3\xa9curit\xc3\xa9 au togo : l\xe2\x80\x99ancy outille les m\xc3\xa9dias \xc3\xa0 kpalim\xc3\xa9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://leadelles.tg/index.php/author/carole/\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour la pr\xc3\xa9sidente de l\xe2\x80\x99afcet, annie gon\xc3\xa7alves gbado\xc3\xa8, ce jubil\xc3\xa9 d\xe2\x80\x99argent d\xc3\xa9passe le simple cadre comm\xc3\xa9moratif. il s\xe2\x80\x99agit plut\xc3\xb4t d\xe2\x80\x99un tournant strat\xc3\xa9gique pour l\xe2\x80\x99organisation, appel\xc3\xa9e \xc3\xa0 se r\xc3\xa9inventer. <strong>\xc2\xabvingt-cinq ans, c\xe2\x80\x99est beaucoup et c\xe2\x80\x99est peu \xc3\xa0 la fois dans la vie d\xe2\x80\x99une organisation. cette conf\xc3\xa9rence doit susciter un nouvel \xc3\xa9lan aupr\xc3\xa8s des femmes entrepreneures et les encourager \xc3\xa0 s\xe2\x80\x99approprier davantage les outils du num\xc3\xa9rique \xc2\xbb</strong>, a-t-elle indiqu\xc3\xa9. dans cette dynamique, elle a annonc\xc3\xa9 une s\xc3\xa9rie d\xe2\x80\x99initiatives futures, notamment des s\xc3\xa9minaires, des ateliers de sensibilisation et des actions de proximit\xc3\xa9 destin\xc3\xa9es \xc3\xa0 renforcer les capacit\xc3\xa9s des femmes, en particulier celles des zones rurales, tout en \xc3\xa9largissant l\xe2\x80\x99implantation de l\xe2\x80\x99association \xc3\xa0 l\xe2\x80\x99int\xc3\xa9rieur du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>replac\xc3\xa9e au centre des d\xc3\xa9bats, la notion m\xc3\xaame de transformation digitale a fait l\xe2\x80\x99objet d\xe2\x80\x99un \xc3\xa9clairage approfondi. une distinction essentielle a \xc3\xa9t\xc3\xa9 apport\xc3\xa9e par m\xc3\xa9dissa sama, pr\xc3\xa9sidente de la conf\xc3\xa9d\xc3\xa9ration des jeunes entreprises et start-up du togo et pan\xc3\xa9liste. selon elle, l\xe2\x80\x99usage d\xe2\x80\x99outils num\xc3\xa9riques ne saurait \xc3\xaatre confondu avec une v\xc3\xa9ritable digitalisation de l\xe2\x80\x99entreprise. elle tranche avec clart\xc3\xa9 : <strong>\xc2\xab utiliser des outils num\xc3\xa9riques n\xe2\x80\x99est pas digitaliser son entreprise. la digitalisation consiste \xc3\xa0 repenser l\xe2\x80\x99organisation de l\xe2\x80\x99entreprise, \xc3\xa0 connecter les informations, les processus et les services pour gagner en efficacit\xc3\xa9 et en comp\xc3\xa9titivit\xc3\xa9 \xc2\xbb</strong>, a-t-elle expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans un contexte marqu\xc3\xa9 par l\xe2\x80\x99essor fulgurant de l\xe2\x80\x99intelligence artificielle, elle estime que de nouvelles opportunit\xc3\xa9s s\xe2\x80\x99ouvrent aux entrepreneures africaines. celles-ci peuvent d\xc3\xa9sormais acc\xc3\xa9der \xc3\xa0 des march\xc3\xa9s internationaux, automatiser certaines fonctions et am\xc3\xa9liorer la gestion de leurs activit\xc3\xa9s, ind\xc3\xa9pendamment des barri\xc3\xa8res linguistiques ou du niveau de formation. <strong>\xc2\xab gr\xc3\xa2ce \xc3\xa0 l\xe2\x80\x99intelligence artificielle, une femme entrepreneure peut aujourd\xe2\x80\x99hui vendre \xc3\xa0 l\xe2\x80\x99international, automatiser son service client et mieux g\xc3\xa9rer son activit\xc3\xa9. la digitalisation n\xe2\x80\x99est plus un luxe, mais une n\xc3\xa9cessit\xc3\xa9 \xc2\xbb,</strong> a-t-elle soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>toutefois, cette transition technologique ne peut \xc3\xaatre pleinement effective sans un accompagnement financier adapt\xc3\xa9. l\xe2\x80\x99experte a rappel\xc3\xa9 que la transformation num\xc3\xa9rique d\xe2\x80\x99une entreprise requiert g\xc3\xa9n\xc3\xa9ralement des investissements estim\xc3\xa9s entre 500 000 et 2 millions de francs cfa, appelant ainsi les institutions financi\xc3\xa8res \xc3\xa0 int\xc3\xa9grer davantage les crit\xc3\xa8res digitaux dans l\xe2\x80\x99analyse des projets entrepreneuriaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des consid\xc3\xa9rations techniques et \xc3\xa9conomiques, cette conf\xc3\xa9rence a surtout mis en lumi\xc3\xa8re la place strat\xc3\xa9gique des femmes dans le tissu \xc3\xa9conomique togolais, ainsi que l\xe2\x80\x99urgence de leur fournir des outils adapt\xc3\xa9s pour \xc3\xa9voluer dans un univers de plus en plus num\xc3\xa9ris\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":877,\"width\":\"741px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/img-20260616-wa0305-450x338-1.jpg\" alt=\"\" class=\"wp-image-877\" style=\"width:741px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>les c\xc3\xa9l\xc3\xa9brations du jubil\xc3\xa9 d\xe2\x80\x99argent de l\xe2\x80\x99afcet se poursuivront avec une soir\xc3\xa9e de gala pr\xc3\xa9vue samedi prochain. au programme, des distinctions honorifiques seront d\xc3\xa9cern\xc3\xa9es aux anciennes pr\xc3\xa9sidentes de l\xe2\x80\x99association et \xc3\xa0 plusieurs femmes ayant contribu\xc3\xa9 \xc3\xa0 son rayonnement depuis un quart de si\xc3\xa8cle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, apr\xc3\xa8s 25 ans d\xe2\x80\x99existence, l\xe2\x80\x99afcet ouvre r\xc3\xa9solument un nouveau chapitre, plac\xc3\xa9 sous le signe de l\xe2\x80\x99innovation, de la formation et de la transformation digitale au service de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin togolais.</p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.133.225
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1384961256 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.19.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong>dans un monde \xc3\xa9conomique en mutation rapide o\xc3\xb9 le digital redessine les r\xc3\xa8gles du jeu entrepreneurial, l\xe2\x80\x99association des femmes cheffes d\xe2\x80\x99entreprise du togo (afcet) a marqu\xc3\xa9 une halte strat\xc3\xa9gique. le 16 juin 2026, elle a c\xc3\xa9l\xc3\xa9br\xc3\xa9 son 25e anniversaire \xc3\xa0 travers une conf\xc3\xa9rence-d\xc3\xa9bat d\xe2\x80\x99envergure autour d\xe2\x80\x99un th\xc3\xa8me central : \xc2\xab les entreprises f\xc3\xa9minines \xc3\xa0 l\xe2\x80\x99\xc3\xa8re du num\xc3\xa9rique et du digital \xc2\xbb. une rencontre dense, rassemblant entrepreneures, expertes du num\xc3\xa9rique, responsables institutionnels et partenaires techniques, tous r\xc3\xa9unis pour interroger l\xe2\x80\x99avenir des entreprises dirig\xc3\xa9es par des femmes face aux d\xc3\xa9fis de la transformation digitale.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des \xc3\xa9changes, une pr\xc3\xa9occupation majeure s\xe2\x80\x99est impos\xc3\xa9e : comment renforcer la comp\xc3\xa9titivit\xc3\xa9 des entreprises f\xc3\xa9minines dans un environnement o\xc3\xb9 la ma\xc3\xaetrise des outils num\xc3\xa9riques devient un levier d\xc3\xa9cisif de survie et de croissance. pendant plusieurs heures de discussions, les participantes ont explor\xc3\xa9 les voies possibles d\xe2\x80\x99une adaptation efficace \xc3\xa0 cette nouvelle donne \xc3\xa9conomique mondiale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lire l'article : <a>cybers\xc3\xa9curit\xc3\xa9 au togo : l\xe2\x80\x99ancy outille les m\xc3\xa9dias \xc3\xa0 kpalim\xc3\xa9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://leadelles.tg/index.php/author/carole/\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour la pr\xc3\xa9sidente de l\xe2\x80\x99afcet, annie gon\xc3\xa7alves gbado\xc3\xa8, ce jubil\xc3\xa9 d\xe2\x80\x99argent d\xc3\xa9passe le simple cadre comm\xc3\xa9moratif. il s\xe2\x80\x99agit plut\xc3\xb4t d\xe2\x80\x99un tournant strat\xc3\xa9gique pour l\xe2\x80\x99organisation, appel\xc3\xa9e \xc3\xa0 se r\xc3\xa9inventer. <strong>\xc2\xabvingt-cinq ans, c\xe2\x80\x99est beaucoup et c\xe2\x80\x99est peu \xc3\xa0 la fois dans la vie d\xe2\x80\x99une organisation. cette conf\xc3\xa9rence doit susciter un nouvel \xc3\xa9lan aupr\xc3\xa8s des femmes entrepreneures et les encourager \xc3\xa0 s\xe2\x80\x99approprier davantage les outils du num\xc3\xa9rique \xc2\xbb</strong>, a-t-elle indiqu\xc3\xa9. dans cette dynamique, elle a annonc\xc3\xa9 une s\xc3\xa9rie d\xe2\x80\x99initiatives futures, notamment des s\xc3\xa9minaires, des ateliers de sensibilisation et des actions de proximit\xc3\xa9 destin\xc3\xa9es \xc3\xa0 renforcer les capacit\xc3\xa9s des femmes, en particulier celles des zones rurales, tout en \xc3\xa9largissant l\xe2\x80\x99implantation de l\xe2\x80\x99association \xc3\xa0 l\xe2\x80\x99int\xc3\xa9rieur du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>replac\xc3\xa9e au centre des d\xc3\xa9bats, la notion m\xc3\xaame de transformation digitale a fait l\xe2\x80\x99objet d\xe2\x80\x99un \xc3\xa9clairage approfondi. une distinction essentielle a \xc3\xa9t\xc3\xa9 apport\xc3\xa9e par m\xc3\xa9dissa sama, pr\xc3\xa9sidente de la conf\xc3\xa9d\xc3\xa9ration des jeunes entreprises et start-up du togo et pan\xc3\xa9liste. selon elle, l\xe2\x80\x99usage d\xe2\x80\x99outils num\xc3\xa9riques ne saurait \xc3\xaatre confondu avec une v\xc3\xa9ritable digitalisation de l\xe2\x80\x99entreprise. elle tranche avec clart\xc3\xa9 : <strong>\xc2\xab utiliser des outils num\xc3\xa9riques n\xe2\x80\x99est pas digitaliser son entreprise. la digitalisation consiste \xc3\xa0 repenser l\xe2\x80\x99organisation de l\xe2\x80\x99entreprise, \xc3\xa0 connecter les informations, les processus et les services pour gagner en efficacit\xc3\xa9 et en comp\xc3\xa9titivit\xc3\xa9 \xc2\xbb</strong>, a-t-elle expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans un contexte marqu\xc3\xa9 par l\xe2\x80\x99essor fulgurant de l\xe2\x80\x99intelligence artificielle, elle estime que de nouvelles opportunit\xc3\xa9s s\xe2\x80\x99ouvrent aux entrepreneures africaines. celles-ci peuvent d\xc3\xa9sormais acc\xc3\xa9der \xc3\xa0 des march\xc3\xa9s internationaux, automatiser certaines fonctions et am\xc3\xa9liorer la gestion de leurs activit\xc3\xa9s, ind\xc3\xa9pendamment des barri\xc3\xa8res linguistiques ou du niveau de formation. <strong>\xc2\xab gr\xc3\xa2ce \xc3\xa0 l\xe2\x80\x99intelligence artificielle, une femme entrepreneure peut aujourd\xe2\x80\x99hui vendre \xc3\xa0 l\xe2\x80\x99international, automatiser son service client et mieux g\xc3\xa9rer son activit\xc3\xa9. la digitalisation n\xe2\x80\x99est plus un luxe, mais une n\xc3\xa9cessit\xc3\xa9 \xc2\xbb,</strong> a-t-elle soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>toutefois, cette transition technologique ne peut \xc3\xaatre pleinement effective sans un accompagnement financier adapt\xc3\xa9. l\xe2\x80\x99experte a rappel\xc3\xa9 que la transformation num\xc3\xa9rique d\xe2\x80\x99une entreprise requiert g\xc3\xa9n\xc3\xa9ralement des investissements estim\xc3\xa9s entre 500 000 et 2 millions de francs cfa, appelant ainsi les institutions financi\xc3\xa8res \xc3\xa0 int\xc3\xa9grer davantage les crit\xc3\xa8res digitaux dans l\xe2\x80\x99analyse des projets entrepreneuriaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des consid\xc3\xa9rations techniques et \xc3\xa9conomiques, cette conf\xc3\xa9rence a surtout mis en lumi\xc3\xa8re la place strat\xc3\xa9gique des femmes dans le tissu \xc3\xa9conomique togolais, ainsi que l\xe2\x80\x99urgence de leur fournir des outils adapt\xc3\xa9s pour \xc3\xa9voluer dans un univers de plus en plus num\xc3\xa9ris\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":877,\"width\":\"741px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/img-20260616-wa0305-450x338-1.jpg\" alt=\"\" class=\"wp-image-877\" style=\"width:741px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les c\xc3\xa9l\xc3\xa9brations du jubil\xc3\xa9 d\xe2\x80\x99argent de l\xe2\x80\x99afcet se poursuivront avec une soir\xc3\xa9e de gala pr\xc3\xa9vue samedi prochain. au programme, des distinctions honorifiques seront d\xc3\xa9cern\xc3\xa9es aux anciennes pr\xc3\xa9sidentes de l\xe2\x80\x99association et \xc3\xa0 plusieurs femmes ayant contribu\xc3\xa9 \xc3\xa0 son rayonnement depuis un quart de si\xc3\xa8cle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, apr\xc3\xa8s 25 ans d\xe2\x80\x99existence, l\xe2\x80\x99afcet ouvre r\xc3\xa9solument un nouveau chapitre, plac\xc3\xa9 sous le signe de l\xe2\x80\x99innovation, de la formation et de la transformation digitale au service de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin togolais.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:38:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:38:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:39:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843034&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692741 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 10:39:16 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57838: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:10:39:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9597082&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692742 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:10:39:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792915&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692745 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.180.129.233
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bc9271 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:38:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:38:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:10:39:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921940&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781692740 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.133.123.116
country_id: 1512440
description:
2026-06-17 10:42:20 H=([5.133.123.116]) [5.133.123.116]:2234 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 17 10:43:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.160.40
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/aaa7a0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [17/Jun/2026:10:45:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937625&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781693105 HTTP/1.1" 404 561 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.99
country_id: 1512440
description:
2026-06-17 10:45:46 H=([213.230.87.99]) [213.230.87.99]:27698 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-06-17 10:46:02 dovecot_login authenticator failed for H=([182.95.230.150]) [218.233.182.39]:9718: 535 Incorrect authentication data (set_id=webmaster@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:49:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801304&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781693359 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:49:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392727&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781693363 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.38.84.208
country_id: 2363686
description:
[2026-06-17 10:49:32 +0000] info [webmaild] 156.38.84.208 - rtchayiza@pnls.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 10:50:28 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:54710: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong>dans un monde \xc3\xa9conomique en mutation rapide o\xc3\xb9 le digital redessine les r\xc3\xa8gles du jeu entrepreneurial, l\xe2\x80\x99association des femmes cheffes d\xe2\x80\x99entreprise du togo (afcet) a marqu\xc3\xa9 une halte strat\xc3\xa9gique. le 16 juin 2026, elle a c\xc3\xa9l\xc3\xa9br\xc3\xa9 son 25e anniversaire \xc3\xa0 travers une conf\xc3\xa9rence-d\xc3\xa9bat d\xe2\x80\x99envergure autour d\xe2\x80\x99un th\xc3\xa8me central : \xc2\xab les entreprises f\xc3\xa9minines \xc3\xa0 l\xe2\x80\x99\xc3\xa8re du num\xc3\xa9rique et du digital \xc2\xbb. une rencontre dense, rassemblant entrepreneures, expertes du num\xc3\xa9rique, responsables institutionnels et partenaires techniques, tous r\xc3\xa9unis pour interroger l\xe2\x80\x99avenir des entreprises dirig\xc3\xa9es par des femmes face aux d\xc3\xa9fis de la transformation digitale.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des \xc3\xa9changes, une pr\xc3\xa9occupation majeure s\xe2\x80\x99est impos\xc3\xa9e : comment renforcer la comp\xc3\xa9titivit\xc3\xa9 des entreprises f\xc3\xa9minines dans un environnement o\xc3\xb9 la ma\xc3\xaetrise des outils num\xc3\xa9riques devient un levier d\xc3\xa9cisif de survie et de croissance. pendant plusieurs heures de discussions, les participantes ont explor\xc3\xa9 les voies possibles d\xe2\x80\x99une adaptation efficace \xc3\xa0 cette nouvelle donne \xc3\xa9conomique mondiale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>lire l'article : <a href=\"https://leadelles.tg/index.php/2026/06/17/cybersecurite-au-togo-lancy-outille-les-medias-a-kpalime/\">cybers\xc3\xa9curit\xc3\xa9 au togo : l\xe2\x80\x99ancy outille les m\xc3\xa9dias \xc3\xa0 kpalim\xc3\xa9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://leadelles.tg/index.php/author/carole/\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour la pr\xc3\xa9sidente de l\xe2\x80\x99afcet, annie gon\xc3\xa7alves gbado\xc3\xa8, ce jubil\xc3\xa9 d\xe2\x80\x99argent d\xc3\xa9passe le simple cadre comm\xc3\xa9moratif. il s\xe2\x80\x99agit plut\xc3\xb4t d\xe2\x80\x99un tournant strat\xc3\xa9gique pour l\xe2\x80\x99organisation, appel\xc3\xa9e \xc3\xa0 se r\xc3\xa9inventer. <strong>\xc2\xabvingt-cinq ans, c\xe2\x80\x99est beaucoup et c\xe2\x80\x99est peu \xc3\xa0 la fois dans la vie d\xe2\x80\x99une organisation. cette conf\xc3\xa9rence doit susciter un nouvel \xc3\xa9lan aupr\xc3\xa8s des femmes entrepreneures et les encourager \xc3\xa0 s\xe2\x80\x99approprier davantage les outils du num\xc3\xa9rique \xc2\xbb</strong>, a-t-elle indiqu\xc3\xa9. dans cette dynamique, elle a annonc\xc3\xa9 une s\xc3\xa9rie d\xe2\x80\x99initiatives futures, notamment des s\xc3\xa9minaires, des ateliers de sensibilisation et des actions de proximit\xc3\xa9 destin\xc3\xa9es \xc3\xa0 renforcer les capacit\xc3\xa9s des femmes, en particulier celles des zones rurales, tout en \xc3\xa9largissant l\xe2\x80\x99implantation de l\xe2\x80\x99association \xc3\xa0 l\xe2\x80\x99int\xc3\xa9rieur du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>replac\xc3\xa9e au centre des d\xc3\xa9bats, la notion m\xc3\xaame de transformation digitale a fait l\xe2\x80\x99objet d\xe2\x80\x99un \xc3\xa9clairage approfondi. une distinction essentielle a \xc3\xa9t\xc3\xa9 apport\xc3\xa9e par m\xc3\xa9dissa sama, pr\xc3\xa9sidente de la conf\xc3\xa9d\xc3\xa9ration des jeunes entreprises et start-up du togo et pan\xc3\xa9liste. selon elle, l\xe2\x80\x99usage d\xe2\x80\x99outils num\xc3\xa9riques ne saurait \xc3\xaatre confondu avec une v\xc3\xa9ritable digitalisation de l\xe2\x80\x99entreprise. elle tranche avec clart\xc3\xa9 : <strong>\xc2\xab utiliser des outils num\xc3\xa9riques n\xe2\x80\x99est pas digitaliser son entreprise. la digitalisation consiste \xc3\xa0 repenser l\xe2\x80\x99organisation de l\xe2\x80\x99entreprise, \xc3\xa0 connecter les informations, les processus et les services pour gagner en efficacit\xc3\xa9 et en comp\xc3\xa9titivit\xc3\xa9 \xc2\xbb</strong>, a-t-elle expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans un contexte marqu\xc3\xa9 par l\xe2\x80\x99essor fulgurant de l\xe2\x80\x99intelligence artificielle, elle estime que de nouvelles opportunit\xc3\xa9s s\xe2\x80\x99ouvrent aux entrepreneures africaines. celles-ci peuvent d\xc3\xa9sormais acc\xc3\xa9der \xc3\xa0 des march\xc3\xa9s internationaux, automatiser certaines fonctions et am\xc3\xa9liorer la gestion de leurs activit\xc3\xa9s, ind\xc3\xa9pendamment des barri\xc3\xa8res linguistiques ou du niveau de formation. <strong>\xc2\xab gr\xc3\xa2ce \xc3\xa0 l\xe2\x80\x99intelligence artificielle, une femme entrepreneure peut aujourd\xe2\x80\x99hui vendre \xc3\xa0 l\xe2\x80\x99international, automatiser son service client et mieux g\xc3\xa9rer son activit\xc3\xa9. la digitalisation n\xe2\x80\x99est plus un luxe, mais une n\xc3\xa9cessit\xc3\xa9 \xc2\xbb,</strong> a-t-elle soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>toutefois, cette transition technologique ne peut \xc3\xaatre pleinement effective sans un accompagnement financier adapt\xc3\xa9. l\xe2\x80\x99experte a rappel\xc3\xa9 que la transformation num\xc3\xa9rique d\xe2\x80\x99une entreprise requiert g\xc3\xa9n\xc3\xa9ralement des investissements estim\xc3\xa9s entre 500 000 et 2 millions de francs cfa, appelant ainsi les institutions financi\xc3\xa8res \xc3\xa0 int\xc3\xa9grer davantage les crit\xc3\xa8res digitaux dans l\xe2\x80\x99analyse des projets entrepreneuriaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 des consid\xc3\xa9rations techniques et \xc3\xa9conomiques, cette conf\xc3\xa9rence a surtout mis en lumi\xc3\xa8re la place strat\xc3\xa9gique des femmes dans le tissu \xc3\xa9conomique togolais, ainsi que l\xe2\x80\x99urgence de leur fournir des outils adapt\xc3\xa9s pour \xc3\xa9voluer dans un univers de plus en plus num\xc3\xa9ris\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":877,\"width\":\"741px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/img-20260616-wa0305-450x338-1.jpg\" alt=\"\" class=\"wp-image-877\" style=\"width:741px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les c\xc3\xa9l\xc3\xa9brations du jubil\xc3\xa9 d\xe2\x80\x99argent de l\xe2\x80\x99afcet se poursuivront avec une soir\xc3\xa9e de gala pr\xc3\xa9vue samedi prochain. au programme, des distinctions honorifiques seront d\xc3\xa9cern\xc3\xa9es aux anciennes pr\xc3\xa9sidentes de l\xe2\x80\x99association et \xc3\xa0 plusieurs femmes ayant contribu\xc3\xa9 \xc3\xa0 son rayonnement depuis un quart de si\xc3\xa8cle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, apr\xc3\xa8s 25 ans d\xe2\x80\x99existence, l\xe2\x80\x99afcet ouvre r\xc3\xa9solument un nouveau chapitre, plac\xc3\xa9 sous le signe de l\xe2\x80\x99innovation, de la formation et de la transformation digitale au service de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin togolais.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:52:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.127.244.74
country_id: 2750405
description:
2026-06-17 10:51:48 dovecot_login authenticator failed for H=ip-213-127-244-74.ip.prioritytelecom.net ([23.252.224.216]) [213.127.244.74]:48063: 535 Incorrect authentication data (set_id=arts@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-17 10:51:54 +0000] info [cpaneld] 80.248.64.198 NEW pnls:ogfNUGs7cdSbb3Ze address=80.248.64.198,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:52:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:10:52:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:52:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.127.244.74
country_id: 2750405
description:
Jun 17 10:51:46 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.127.244.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.169.7
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/756274310 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:10:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672137&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781693636 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:10:54:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10248553&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781693647 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:10:53:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208874&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781693629 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:10:53:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065508&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781693635 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4098c7f7ac1d05f912ea17a3eb06a1b9a6913250||Title:2r9fdeutfmwfzpc||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (104.28.230.244) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.55.216.56
country_id: 1814991
description:
2026-06-17 10:57:23 H=([0.0.0.0]) [116.55.216.56]:15439 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.226.66
country_id: 1269750
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69982.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3db9ad946e74cf163fdc0cb46eeec9a11b50f94||Title:z95ncdbaos4aoe||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 49.43.226.66
country_id: 1269750
domain: lepoint-actu.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.8374362294502058||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ec67a5eda0e5f3f99d8db4eb50f29a25e15a27f||Title:bpympze7zpfw7u||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9e90c7c903bb08fdf1853f62e44043cf4ff7a19||Title:b42yorwewp0s92i9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - edogbe@pnls.tg [06/17/2026:11:00:32 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: edogbe@pnls.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.160
country_id: 1880251
description:
47.128.119.160 - - [17/Jun/2026:11:00:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869715&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14439&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694027 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14439" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.160


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3af985496ec49081d7137d958bd0fe5b5d355505||Title:9a6lrdimcorv47wpp6||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f7153e3d5955530efc72aa1439498e51f53232a6||Title:wk8yrd71vs7qzbr||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:487c2d9b75277ec555bd16acb3e350b945f6546b||Title:pnnkbgkexfm7xb4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.163.89.108
country_id: 3996063
description:
189.163.89.108 - - [17/Jun/2026:11:04:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859221&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmoyen-orient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694246 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/moyen-orient/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2324.1430 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.163.89.108


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d57a94f6c445007214efdd01a6c5b90e416032b||Title:qw8tcyp9xodw0h8zq5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.87.176.247
country_id: 3469034
description:
187.87.176.247 - - [17/Jun/2026:11:03:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647753&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchidinma%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694218 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chidinma/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.3433.1379 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.87.176.247


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.2.250
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.38.jpeg 1600w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.38-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.38-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.38-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.38-1536x1023.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.38-272x182.jpeg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.67.81.45
country_id: 3017382
description:
37.67.81.45 - - [17/Jun/2026:11:03:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316651&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcrl-yali%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694205 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/crl-yali/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.5937.1379 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.67.81.45


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rtchayiza@pnls.tg [06/17/2026:11:04:45 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rtchayiza@pnls.tg


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.251.24.251
country_id: 1522867
description:
2026-06-17 11:04:45 H=([5.251.24.251]) [5.251.24.251]:55208 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81d46400f666444750a4fdb57cdee3278c809a0b||Title:q5hygglzzy0xtfow2||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:05:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405782&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694349 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:05:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:05:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3cda35f4dce105e8dc1b64c1c5e4aacbd7c096f||Title:uolu556je2pmg8cjce||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:05:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:05:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737832&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694349 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1e6ffcc0850980303e148cd893dd37f9db459af0||Title:k13ac0k0pvk2bp0||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42efce63662f31b0f4c726cff48e761ea2b3670d||Title:asrpovbqnk657b||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.91.22.89
country_id: 3017382
description:
2026-06-17 11:07:54 dovecot_plain authenticator failed for H=([100.64.100.6]) [45.91.22.89]:30712: 535 Incorrect authentication data (set_id=deroupartners@confortis.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.83
country_id: 1512440
description:
2026-06-17 11:07:31 H=([213.230.92.83]) [213.230.92.83]:14068 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.205.203.92
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cec0c0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:11:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004142&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694540 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 11:09:14 +0000] info [cpaneld] 157.85.64.85 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4e206e31d787cc9059663f640130299cd8fe95e||Title:g2bca7ispyl73y186||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:11:08:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052397&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694536 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195312&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694539 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.90.150
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/398506915 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:11:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445424&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781694539 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8aea2ea0ee185161f7997a68a836bf63806f5d0||Title:zduzhvg8bxp2ybev||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.64.85
country_id: 1831722
description:
[2026-06-17 11:09:45 +0000] info [cpaneld] 157.85.64.85 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c570043345bd275c851aefd8061ab00c9882334||Title:5e8fez7ripuyr6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.157.24
country_id: 2363686
description:
[2026-06-17 11:11:02 +0000] info [cpaneld] 196.168.157.24 NEW pnls:boCqY7LJwYI3_3Qj address=196.168.157.24,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.91.22.89
country_id: 3017382
description:
2026-06-17 11:10:24 dovecot_plain authenticator failed for H=([100.64.100.6]) [45.91.22.89]:53055: 535 Incorrect authentication data (set_id=deroupartners@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.91.22.89
country_id: 3017382
description:
2026-06-17 11:11:25 dovecot_plain authenticator failed for H=([100.64.100.6]) [45.91.22.89]:43903: 535 Incorrect authentication data (set_id=deroupartners@confortis.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3a449d4f8cc1cbf8f523bb0b635d442e8a19650||Title:4gljq1xg9ehelnbuzc||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rtchayiza@pnls.tg [06/17/2026:11:12:55 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rtchayiza@pnls.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.39.16.182
country_id: 3865483
description:
[2026-06-17 11:13:05 +0000] info [cpaneld] 186.39.16.182 - devbasetg "GET /login/?login_only=1&user=devbasetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbasetg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5625ab8ecb3de956bbfb1464cc5d8c3c59353c4e||Title:ea7t8wrrvix0afjkd||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.73.196.91
country_id: 3469034
description:
[2026-06-17 11:12:58 +0000] info [cpaneld] 187.73.196.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.62.93
country_id: 3865483
description:
[2026-06-17 11:13:01 +0000] info [cpaneld] 138.84.62.93 - devbase "GET /login/?login_only=1&user=devbase&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbase (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.253.59.182
country_id: 2017370
description:
[2026-06-17 11:13:03 +0000] info [cpaneld] 89.253.59.182 - devbas "GET /login/?login_only=1&user=devbas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.161.178.47
country_id: 290291
description:
[2026-06-17 11:13:09 +0000] info [cpaneld] 109.161.178.47 - devb "GET /login/?login_only=1&user=devb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.13.56.224
country_id: 6252001
description:
[2026-06-17 11:13:14 +0000] info [cpaneld] 99.13.56.224 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.129.13.18
country_id: 1210997
description:
[2026-06-17 11:13:15 +0000] info [cpaneld] 114.129.13.18 - devb "GET /login/?login_only=1&user=devb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.120.33.46
country_id: 630336
description:
[2026-06-17 11:13:00 +0000] info [cpaneld] 146.120.33.46 - devbasetg "GET /login/?login_only=1&user=devbasetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devbasetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.146.41.221
country_id: 2635167
description:
[2026-06-17 11:13:05 +0000] info [cpaneld] 109.146.41.221 - devba "GET /login/?login_only=1&user=devba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user devba (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.40.57.46
country_id: 1522867
description:
2026-06-17 11:14:05 H=([89.40.57.46]) [89.40.57.46]:53910 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rtchayiza@pnls.tg [06/17/2026:11:13:32 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rtchayiza@pnls.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.231.133.219
country_id: 3469034
description:
[2026-06-17 11:13:24 +0000] info [cpaneld] 170.231.133.219 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce901a6d0350500484d628a78acc16f8a8494165||Title:fzijsj3xo7pf34||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f63b7d5633ee123ab8d4761200d9a99f702d3f9f||Title:txwxsai10totoqcb7t||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-17 11:16:08 +0000] info [cpaneld] 5.230.153.230 NEW mbyqtkiw:TZxIVzKwxSQkfWrf address=5.230.153.230,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 17 11:16:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 11:15:24 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:47210: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:66ffe239e3414b866bc0e4fc9c0a05b86f3c5bcf||Title:p1wx8f4ghn8l7uu6sl||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 17 11:16:23 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:769094993917959a0f69be97b684c46e0df1aa2e||Title:jxlo8iqfreutvq5z||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.167.186
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-16.209.50.167.186||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.108.51
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.48-768x1024.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.48-225x300.webp 225w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.48.webp 864w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rtchayiza@pnls.tg [06/17/2026:11:18:13 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rtchayiza@pnls.tg


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1e504908767535d63fd69a97376a29380c90b140||Title:t6rfffbhonpuoyl||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.57.221
country_id: 2363686
description:
2026-06-17 11:17:49 dovecot_login authenticator failed for H=([127.0.0.1]) [196.170.57.221]:42324: 535 Incorrect authentication data (set_id=documentation@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a4eb6030d28376445dfe0e2155d668885fe39f7||Title:boh9vq9hv5owqb||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.106.173.222
country_id: 2921044
description:
2026-06-17 11:19:47 H=([87.106.173.222]) [87.106.173.222]:55073 F=<support@renovarix.io> rejected RCPT <support@nic.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d4f90650e199d86bb86c95099993b39729394ae||Title:a9i74gd5g5froxz5h4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.190
country_id: 3017382
description:
[2026-06-17 11:19:35 +0000] info [cpaneld] 5.231.255.190 NEW naduwpdk:ntXy5yD29bIuCj3k address=5.231.255.190,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-17 11:19:39 dovecot_login authenticator failed for H=([211.78.54.14]) [27.71.21.70]:30798: 535 Incorrect authentication data (set_id=no-reply@cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.194.152.58
country_id: 3469034
description:
[2026-06-17 11:20:54 +0000] info [cpaneld] 186.194.152.58 - sococimtg "GET /login/?login_only=1&user=sococimtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococimtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.100.66.237
country_id: 732800
description:
[2026-06-17 11:21:00 +0000] info [cpaneld] 79.100.66.237 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.248.238.23
country_id: 2017370
description:
[2026-06-17 11:21:07 +0000] info [cpaneld] 87.248.238.23 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.251.190
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0030-1024x683-1.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0030-1024x683-1-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0030-1024x683-1-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0030-1024x683-1-272x182.webp 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.87.165.164
country_id: 3469034
description:
[2026-06-17 11:21:08 +0000] info [cpaneld] 177.87.165.164 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.111.185.249
country_id: 1562822
description:
[2026-06-17 11:21:12 +0000] info [cpaneld] 116.111.185.249 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.244.158.87
country_id: 1522867
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/contact/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.215.70.142
country_id: 3469034
description:
[2026-06-17 11:21:00 +0000] info [cpaneld] 177.215.70.142 - sococi "GET /login/?login_only=1&user=sococi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.236.107.188
country_id: 2017370
description:
[2026-06-17 11:21:02 +0000] info [cpaneld] 109.236.107.188 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.190.173.241
country_id: 3865483
description:
[2026-06-17 11:21:05 +0000] info [cpaneld] 201.190.173.241 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any questions relating to exactly where and how to use ||MV:gt;If you have any questions relating to exactly where and how to use ||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.150.92.166
country_id: 3469034
description:
[2026-06-17 11:20:49 +0000] info [cpaneld] 170.150.92.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.18.117.80
country_id: 2017370
description:
[2026-06-17 11:20:58 +0000] info [cpaneld] 84.18.117.80 - sococi "GET /login/?login_only=1&user=sococi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.15.77.223
country_id: 1819730
description:
2026-06-17 11:21:04 dovecot_plain authenticator failed for H=(wxb5djgci7hqnssyg5g) [199.15.77.223]:4913: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.54.79
country_id: 3865483
description:
[2026-06-17 11:21:15 +0000] info [cpaneld] 186.22.54.79 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa297a95e1d3c1d32353e9586dbd84f2637f7cb2||Title:nweq68dolwopn5yty||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.108.109.125
country_id: 294640
description:
[2026-06-17 11:20:51 +0000] info [cpaneld] 84.108.109.125 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:21:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:21:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:22:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948936&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781695323 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.192
country_id: 3469034
description:
Jun 17 11:22:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.255.32.73
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/837768 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa6b134b195eef0138344f6f116d13ccf13c3820||Title:v5moehpom1nx1rl1d9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:11:21:41 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:21:43 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:22:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300041&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781695325 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.131
country_id: 3469034
description:
Jun 17 11:22:29 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.192
country_id: 3469034
description:
Jun 17 11:22:22 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e7a9b38eb16e07dc84479fe8fabdd4a858591126||Title:fze3pdfmrcddjile||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e88c8257837a943c1ddc495eac8f8c6b7d531ab||Title:xejda6h39b5uzbgz9q||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.173.159.91
country_id: 2017370
description:
[2026-06-17 11:24:48 +0000] info [cpaneld] 85.173.159.91 - sodig "GET /login/?login_only=1&user=sodig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.124.71.92
country_id: 1210997
description:
[2026-06-17 11:24:49 +0000] info [cpaneld] 27.124.71.92 - sodi "GET /login/?login_only=1&user=sodi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.56
country_id: 1269750
description:
Jun 17 11:24:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.56 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:11:24:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776473&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781695489 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.200.99
country_id: 3895114
description:
[2026-06-17 11:24:54 +0000] info [cpaneld] 181.43.200.99 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.101.239.243
country_id: 3895114
description:
[2026-06-17 11:24:58 +0000] info [cpaneld] 190.101.239.243 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.234.94.162
country_id: 298795
description:
[2026-06-17 11:24:40 +0000] info [cpaneld] 176.234.94.162 - sodigaztg "GET /login/?login_only=1&user=sodigaztg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodigaztg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.3.123
country_id: 3895114
description:
[2026-06-17 11:24:43 +0000] info [cpaneld] 45.4.3.123 - sodiga "GET /login/?login_only=1&user=sodiga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodiga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.124.84.195
country_id: 2245662
description:
[2026-06-17 11:24:51 +0000] info [cpaneld] 154.124.84.195 - sod "GET /login/?login_only=1&user=sod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sod (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.197.29
country_id: 3469034
description:
[2026-06-17 11:24:53 +0000] info [cpaneld] 45.232.197.29 - sod "GET /login/?login_only=1&user=sod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sod (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.230.244
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26fda148668cdd3f09522942ba0298b5e24790a3||Title:3xj399i5tliv2dj||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.153.170.201
country_id: 1210997
description:
[2026-06-17 11:24:36 +0000] info [cpaneld] 103.153.170.201 - sodigaz "GET /login/?login_only=1&user=sodigaz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.68.47
country_id: 1643084
description:
[2026-06-17 11:24:46 +0000] info [cpaneld] 182.8.68.47 - sodiga "GET /login/?login_only=1&user=sodiga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodiga (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:11:24:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802373&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781695490 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:11:24:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712217&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781695492 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.16.182.179
country_id: 953987
description:
[2026-06-17 11:24:35 +0000] info [cpaneld] 165.16.182.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.50.233.88
country_id: 3658394
description:
[2026-06-17 11:24:38 +0000] info [cpaneld] 200.50.233.88 - sodigaz "GET /login/?login_only=1&user=sodigaz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.103.18.147
country_id: 3865483
description:
[2026-06-17 11:24:43 +0000] info [cpaneld] 191.103.18.147 - sodigaztg "GET /login/?login_only=1&user=sodigaztg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodigaztg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:11:24:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313512&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781695486 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.38.84.208
country_id: 2363686
description:
2026-06-17 11:24:58 dovecot_login authenticator failed for H=(ERICK) [156.38.84.208]:50110: 535 Incorrect authentication data (set_id=eamouzouvi@pnls.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.15.71
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0050-1024x683-1.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0050-1024x683-1-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0050-1024x683-1-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2023/08/F9A0050-1024x683-1-272x182.webp 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.38.84.208
country_id: 2363686
description:
2026-06-17 11:26:38 dovecot_login authenticator failed for H=(ERICK) [156.38.84.208]:62237: 535 Incorrect authentication data (set_id=eamouzouvi@pnls.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.247.158.84
country_id: 3469034
description:
[2026-06-17 11:27:21 +0000] info [cpaneld] 170.247.158.84 - soeurndetogo "GET /login/?login_only=1&user=soeurndetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.73.24.26
country_id: 6254930
description:
[2026-06-17 11:27:16 +0000] info [cpaneld] 94.73.24.26 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.140.167.66
country_id: 1643084
description:
[2026-06-17 11:27:17 +0000] info [cpaneld] 158.140.167.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.40.91.18
country_id: 286963
description:
[2026-06-17 11:27:22 +0000] info [cpaneld] 37.40.91.18 - soeurndetogocom "GET /login/?login_only=1&user=soeurndetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.0.10
country_id: 290557
description:
[2026-06-17 11:27:44 +0000] info [cpaneld] 92.99.0.10 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.26.236.59
country_id: 2017370
description:
[2026-06-17 11:27:48 +0000] info [cpaneld] 212.26.236.59 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.253.69.218
country_id: 298795
description:
[2026-06-17 11:27:51 +0000] info [cpaneld] 88.253.69.218 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.46.190
country_id: 2017370
description:
[2026-06-17 11:27:54 +0000] info [cpaneld] 95.26.46.190 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


