# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.184.80.190
country_id: 3469034
description:
Jun 20 01:59:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.184.80.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.162.99.230
country_id: 3077311
description:
Jun 20 01:59:51 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.162.99.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.142.83.58
country_id: 2542007
description:
41.142.83.58 - - [20/Jun/2026:01:59:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788756&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-233353retidm28der.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781920794 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-233353retidm28der.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.142.83.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.209
country_id: 3865483
description:
Jun 20 02:02:42 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.84.76
country_id: 6252001
description:
[2026-06-20 02:03:37 +0000] info [cpaneld] 82.40.84.76 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [20/Jun/2026:02:03:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275742&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921032 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jun 20 02:04:49 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.249.133
country_id: 3469034
description:
Jun 20 02:06:42 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.249.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.18
country_id: 1269750
description:
Jun 20 02:07:12 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 193.221.201.93
country_id: 2017370
description:
2026-06-20 02:10:16 H=([193.221.201.93]) [193.221.201.93]:13744 F=<sarah@futurhealth.living> rejected RCPT <kumar@white-ways.com>: The mail server could not deliver mail to kumar@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 20 02:11:13 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 20 02:12:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.173
country_id: 2300660
description:
Jun 20 02:13:05 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.173 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:13:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277897&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921598 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:13:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988453&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921608 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.181
country_id: 732800
description:
Jun 20 02:13:37 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.181 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:13:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314632&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921617 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:13:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923173&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781921617 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:15:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:15:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.206
country_id: 3469034
description:
Jun 20 02:16:07 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.225
country_id: 690791
description:
Jun 20 02:16:04 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.141.32
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/concours-de-recrutement-a-lotr-les-resultats-disponibles-depuis-ce-1er-fevrier/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:22:20 +0000] info [cpaneld] 185.55.240.13 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.6.245
country_id: 3932488
description:
179.6.6.245 - - [20/Jun/2026:02:22:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750675&pdata=https%253A%252F%252Ftogodailynews.tg%252Falain-jean-giresse-et-la-tunisie-chassent-le-chat-noir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922145 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/alain-jean-giresse-et-la-tunisie-chassent-le-chat-noir/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.5516.1270 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.6.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.95.15
country_id: 6252001
description:
[2026-06-20 02:23:04 +0000] info [cpaneld] 82.40.95.15 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:24:07 +0000] info [cpaneld] 185.55.240.13 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.64.7
country_id: 2017370
description:
45.91.64.7 - - [20/Jun/2026:02:24:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896367&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922296 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.7


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.91.64.8
country_id: 2017370
description:
45.91.64.8 - - [20/Jun/2026:02:25:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789269&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922299 HTTP/2.0" 404 561 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.8


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.91.64.8
country_id: 2017370
description:
45.91.64.8 - - [20/Jun/2026:02:25:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 154.70.82.246 "https://154.70.82.246/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789269&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922299" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.8


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.91.64.6
country_id: 2017370
description:
45.91.64.6 - - [20/Jun/2026:02:25:18 +0000] "GET /favicon.ico HTTP/1.1" 415 587 154.70.82.246 "https://154.70.82.246/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789269&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922299" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.6


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.209.149.107
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.29.235
country_id: 2542007
description:
[2026-06-20 02:24:52 +0000] info [cpaneld] 41.141.29.235 - kvwytkkw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kvwytkkw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:27:11 +0000] info [cpaneld] 185.55.240.13 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.129.55
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-29.191.102.129.55||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:30:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606814&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922613 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:30:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065565&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922614 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:30:50 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 209.50.187.100
country_id: 6251999
domain: metaart.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.114.103.42
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-28-1024x683-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 104.207.33.159
country_id: 6252001
domain: metaart.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 209.50.187.100
country_id: 6251999
domain: metaart.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.171.171.97
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:31:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199768&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922697 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:31:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067669&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781922697 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.171.171.97
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:32:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:32:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:33:07 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.150.139
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-02-at-1.20.08-PM-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.38.97.215
country_id: 2750405
description:
[2026-06-20 02:35:02 +0000] info [cpaneld] 89.38.97.215 - nwvfmxat "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:38:08 +0000] info [cpaneld] 195.3.220.88 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 204.217.131.12
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-39.204.217.131.12||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.79
country_id: 3469034
description:
Jun 20 02:41:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.79
country_id: 3469034
description:
Jun 20 02:41:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.219.166.171
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/09/027981ec990f556d8370a14e3e774061_XL.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2020/09/027981ec990f556d8370a14e3e774061_XL-300x204.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.100.145.105
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/08/WhatsApp-Image-2022-08-14-at-15.28.49-1.jpeg 512w, http:/togodailynews.tg/wp-content/uploads/2022/08/WhatsApp-Image-2022-08-14-at-15.28.49-1-300x169.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/08/WhatsApp-Image-2022-08-14-at-15.28.49-1-510x288.jpeg 510w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.61.244.30
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/86163050 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.50.239.192
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/pharmacie-indre-et-loire-beaulieu-les-loches-960x640-960x640-1-960x630-1.webp 960w, http:/togodailynews.tg/wp-content/uploads/2025/03/pharmacie-indre-et-loire-beaulieu-les-loches-960x640-960x640-1-960x630-1-300x197.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/03/pharmacie-indre-et-loire-beaulieu-les-loches-960x640-960x640-1-960x630-1-768x504.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.188.109
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:191.101.188.109||TA:191.101.188.109||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.125
country_id: 798544
description:
Jun 20 02:43:55 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.145
country_id: 3469034
description:
Jun 20 02:43:29 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.145 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:43:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923691&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923414 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:43:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131861&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923418 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.39.228.73
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG_20210928_094157_409.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.88.253.64
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/04/FB_IMG_1618986940410.jpg 720w, http:/togodailynews.tg/wp-content/uploads/2021/04/FB_IMG_1618986940410-300x170.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.56.66
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027.jpg 1040w, http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027-300x150.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027-768x384.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/03/IMG-20200310-WA0027-1024x512.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:46:37 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:46:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538646&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923598 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.42
country_id: 3469034
description:
Jun 20 02:46:57 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:46:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661334&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923594 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:48:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:48:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.14
country_id: 690791
description:
Jun 20 02:49:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:49:36 +0000] info [cpaneld] 195.3.220.88 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 02:50:19 +0000] info [cpaneld] 185.55.240.13 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.138.59.18
country_id: 2440476
description:
Jun 20 02:51:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.138.59.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.160
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-52.206.232.2.160||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.144
country_id: 3469034
description:
Jun 20 02:52:39 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.65.142
country_id: 3469034
description:
Jun 20 02:52:48 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.65.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.6.47.167
country_id: 3625428
description:
190.6.47.167 - - [20/Jun/2026:02:52:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6474136&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-delegation-de-shelter-afrique-rencontre-le-ministre-de-lhabitat-du-nigeria-avant-laga%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781923969 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-delegation-de-shelter-afrique-rencontre-le-ministre-de-lhabitat-du-nigeria-avant-laga/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.6.47.167


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.212
country_id: 3469034
description:
Jun 20 02:53:11 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:52:29 +0000] info [cpaneld] 195.3.220.88 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:54:57 +0000] info [cpaneld] 195.3.220.88 - ecritoir "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ecritoir (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 02:55:34 +0000] info [cpaneld] 195.3.220.88 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 02:55:53 +0000] info [cpaneld] 152.42.200.110 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.76
country_id: 3469034
description:
Jun 20 02:55:56 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.76 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.187.114.97
country_id: 597427
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:193.187.114.97||TA:193.187.114.97||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:02:57:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393492&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924228 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:57:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169945&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924232 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:00:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:60139: 535 Incorrect authentication data (set_id=q)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:02:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674087&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924392 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:02:59:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842521&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781924394 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 20 03:00:17 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.156
country_id: 298795
description:
Jun 20 03:00:43 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.132.30
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/Press-5G-part1-250F_TogodayliNews.webp 970w, http:/togodailynews.tg/wp-content/uploads/2025/03/Press-5G-part1-250F_TogodayliNews-300x28.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/03/Press-5G-part1-250F_TogodayliNews-768x71.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:01:56 +0000] info [cpaneld] 195.3.220.88 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:02:46 +0000] info [cpaneld] 195.3.220.88 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.175.160
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:revue-annuelle-des-reformes-communautaire-de-luemoa-lauto-evaluation-tenue-a-lome/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:04:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:04:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:04:22 +0000] info [cpaneld] 195.3.220.88 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.22
country_id: 1269750
description:
Jun 20 03:03:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:04:47 +0000] info [cpaneld] 195.3.220.88 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:05:32 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-20 03:05:55 +0000] info [cpaneld] 195.3.220.88 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.21.182
country_id: 3865483
description:
Jun 20 03:06:03 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.21.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:06:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:43516: 535 Incorrect authentication data (set_id=klaudia1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 20 03:06:55 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 03:08:07 +0000] info [cpaneld] 185.55.240.13 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.227
country_id: 3469034
description:
Jun 20 03:10:03 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.194.230.10
country_id: 3996063
description:
Jun 20 03:10:24 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.194.230.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.83
country_id: 3175395
description:
Jun 20 03:10:02 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.194.230.10
country_id: 3996063
description:
Jun 20 03:10:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.194.230.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:12:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6922140&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925119 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:12:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853528&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925121 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.130.201
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/bcb3a7 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:13:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:24187: 535 Incorrect authentication data (set_id=contacts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.230
country_id: 3469034
description:
Jun 20 03:13:57 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.85.189
country_id: 3865483
description:
Jun 20 03:14:46 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 20 03:14:32 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:03:15:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261864&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925330 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:15:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116740&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925332 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.163
country_id: 3469034
description:
Jun 20 03:16:50 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:20:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:30731: 535 Incorrect authentication data (set_id=12121946)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:20:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:20:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.100.98
country_id: 6252001
description:
[2026-06-20 03:20:45 +0000] info [cpaneld] 82.40.100.98 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.93
country_id: 3469034
description:
Jun 20 03:21:55 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jun 20 03:22:15 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.190
country_id: 3175395
description:
Jun 20 03:23:02 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jun 20 03:22:28 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.114
country_id: 3175395
description:
Jun 20 03:24:49 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:25:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856155&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925948 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:25:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262378&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781925951 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-20 03:27:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:23052: 535 Incorrect authentication data (set_id=ara)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 20 03:27:00 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.74.177
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/5e4f41 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.247.115
country_id: 3469034
description:
Jun 20 03:27:38 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.247.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.127.3
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.127.3
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun 20 03:28:33 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.155
country_id: 298795
description:
Jun 20 03:29:18 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.155
country_id: 298795
description:
Jun 20 03:29:31 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 03:29:30 +0000] info [cpaneld] 185.55.240.13 - wao@waotherapy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.85.187
country_id: 3865483
description:
Jun 20 03:29:53 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.85.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 20 03:32:00 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:32:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920805&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926324 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:03:32:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674138&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926327 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.222.63.213
country_id: 99237
description:
176.222.63.213 - - [20/Jun/2026:03:32:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132841&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecomposition-de-la-ceni%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926366 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recomposition-de-la-ceni/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.5975.1817 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.222.63.213


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.192.110.73
country_id: 1819730
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/photo-8-mars-2-768x615.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.12.250
country_id: 3469034
description:
Jun 20 03:35:45 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.12.250 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:37:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.83.124.76
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/953695906 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:37:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.91
country_id: 298795
description:
Jun 20 03:38:10 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.216
country_id: 2395170
description:
Jun 20 03:38:11 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 03:38:24 +0000] info [cpaneld] 185.55.240.13 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.66
country_id: 933860
description:
Jun 20 03:38:51 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.87
country_id: 798544
description:
Jun 20 03:39:07 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.137
country_id: 3865483
description:
Jun 20 03:38:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.184
country_id: 1269750
description:
Jun 20 03:40:22 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.184 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.222.196.104
country_id: 1814991
description:
54.222.196.104 - - [20/Jun/2026:03:39:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259548&pdata=https%253A%252F%252Ftogodailynews.tg%252Facces-a-leau-potable-pour-tous-victoire-tomegah-dogbe-visite-3-chantiers-de-construction-de-chateau-deau-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926767 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/acces-a-leau-potable-pour-tous-victoire-tomegah-dogbe-visite-3-chantiers-de-construction-de-chateau-deau-a-lome/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.7376.1531 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.222.196.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.184
country_id: 1269750
description:
Jun 20 03:40:30 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.178
country_id: 798544
description:
Jun 20 03:40:41 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.90.118.19
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/278172457 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:41:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262676&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926912 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:42:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118746&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781926915 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.165.121
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:199.96.165.121||TA:199.96.165.121||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jun 20 03:43:36 ns5 auth[79940]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:45:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671831&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927144 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:03:45:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723436&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927144 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 34.221.200.0
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.221.200.0/azenv4.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.83.40.99
country_id: 1643084
description:
203.83.40.99 - - [20/Jun/2026:03:48:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10056293&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcua-au-kenya-edem-tengue-appelle-a-des-mesures-concretes-contre-la-peche-inn-en-afrique&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927298 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cua-au-kenya-edem-tengue-appelle-a-des-mesures-concretes-contre-la-peche-inn-en-afrique" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.83.40.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.252
country_id: 1269750
description:
Jun 20 03:48:38 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jun 20 03:49:57 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.171.107
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/b09789 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.255.47
country_id: 798544
description:
Jun 20 03:50:37 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.255.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.227.37
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46-768x432.webp 768w, http:/togodailynews.tg/wp-content/uploads/2025/12/WhatsApp-Image-2025-12-22-at-20.51.46.webp 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:52:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:52:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.120.115.21
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/5a5243 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.169
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-52.206.232.2.169||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 20 03:53:03 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jun 20 03:53:57 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:03:55:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000030&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927737 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.193
country_id: 690791
description:
Jun 20 03:56:07 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.193 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.36.122.22
country_id: 1210997
description:
202.36.122.22 - - [20/Jun/2026:03:55:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027695&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fagoe-nyive-4-le-sort-du-maire-dans-les-mains-du-juge-administratif%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927736 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/agoe-nyive-4-le-sort-du-maire-dans-les-mains-du-juge-administratif/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.36.122.22


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:03:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776779&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781927736 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77350441
name: IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 113.15.120.184
country_id: 1814991
domain: misstogo.tg
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:binance odkazov'y bonus||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.103
country_id: 3469034
description:
Jun 20 04:00:41 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.149.107.172
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/744273641 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:01:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212829&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928110 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:01:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196586&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928112 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.180.200.5
country_id: 1694008
description:
103.180.200.5 - - [20/Jun/2026:04:01:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724462&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14578&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928113 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14578" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.2269.1456 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.180.200.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 20 04:02:18 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 20 04:02:43 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 20 04:03:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.227.39
country_id: 1668284
description:
Jun 20 04:03:34 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.227.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.227.39
country_id: 1668284
description:
2026-06-20 04:03:36 dovecot_plain authenticator failed for H=(6jn732xkye2eaozftgsoi8ar81g148) [165.154.227.39]:42710: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.81.76
country_id: 6252001
description:
[2026-06-20 04:03:37 +0000] info [cpaneld] 82.40.81.76 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.13.69.103
country_id: 3175395
description:
Jun 20 04:03:57 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.13.69.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:05:32 +0000] info [cpaneld] 185.55.240.13 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.221.219.14
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/456c32 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.178.104
country_id: 732800
description:
Jun 20 04:07:00 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jun 20 04:07:40 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.201
country_id: 3469034
description:
Jun 20 04:07:42 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.37.22.147
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33.webp 1040w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33-300x135.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33-1024x461.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.33-768x346.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:08:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:08:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
country_id: 1814991
description:
Jun 20 04:07:33 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:09:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027729&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928559 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jun 20 04:08:29 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.13.110.15
country_id: 3865483
description:
Jun 20 04:08:30 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.13.110.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.187
country_id: 690791
description:
Jun 20 04:09:09 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.187 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.187.66.220
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/08/IMG-20220826-WA0000-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.55.161.43
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434.jpg 1280w, http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434-768x432.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/03/2164225-lancement-du-plus-grand-fonds-dobligations-vertes-au-monde-web-tete-0301482164434-1024x576.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:09:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315627&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928564 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.113.114.67
country_id: 1269750
description:
Jun 20 04:09:36 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.113.114.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.1
country_id: 3175395
description:
Jun 20 04:11:23 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.1
country_id: 3175395
description:
Jun 20 04:11:31 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.46
country_id: 953987
description:
Jun 20 04:11:29 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.136.149
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/91029270 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.232.51.223
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/MACHINE-860x452-1.webp 860w, http:/togodailynews.tg/wp-content/uploads/2026/02/MACHINE-860x452-1-300x158.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/MACHINE-860x452-1-768x404.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any sort of concerns concerning where and ways to make use of ||MV:gt;If you have any sort of concerns concerning where and ways to make use of ||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.233.252
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:66.146.233.252||TA:66.146.233.252||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.28.232
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/519931327 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 20 04:16:02 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:16:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158002&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928967 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:16:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6594201&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928968 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.171.176.156
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/655c54 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.245.93.35
country_id: 1282988
description:
43.245.93.35 - - [20/Jun/2026:04:15:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197864&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Frentree-du-2-novembre-au-togo-les-eleves-seront-30-et-60-par-classe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928956 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/rentree-du-2-novembre-au-togo-les-eleves-seront-30-et-60-par-classe" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.245.93.35


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.119.34.87
country_id: 1282988
description:
111.119.34.87 - - [20/Jun/2026:04:16:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918807&pdata=https%253A%252F%252Ftogodailynews.tg%252Fecobank-au-dessus-des-2-milliards-de-dollars-de-revenus-en-2023&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781928961 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ecobank-au-dessus-des-2-milliards-de-dollars-de-revenus-en-2023" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.119.34.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.94.184
country_id: 99237
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/developpement-inclusif-le-duo-togo-pnud-est-tres-gagnant/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.94.184
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/developpement-inclusif-le-duo-togo-pnud-est-tres-gagnant/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.232.64.199
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/made-in-togo-victoire-tomegah-dogbe-visite-la-soproem/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 152.39.229.96
country_id: 6252001
domain: ekeasarl.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/106.0.5249.30 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.92
country_id: 1269750
description:
Jun 20 04:20:14 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.92
country_id: 1269750
description:
Jun 20 04:20:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.92 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.213.72
country_id: 1733045
description:
113.211.213.72 - - [20/Jun/2026:04:20:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142577&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Ftogo-compte-rendu-du-conseil-des-ministres-du-24-mars-2021&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929249 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/togo-compte-rendu-du-conseil-des-ministres-du-24-mars-2021" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.213.72


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:23:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:23:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 20 04:24:36 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.211
country_id: 3469034
description:
Jun 20 04:24:59 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.64.35
country_id: 6252001
description:
[2026-06-20 04:25:12 +0000] info [cpaneld] 82.40.64.35 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.176
country_id: 2300660
description:
Jun 20 04:25:20 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:25:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804643&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929530 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:25:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169639&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929531 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.2
country_id: 3469034
description:
Jun 20 04:25:42 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.104
country_id: 2413451
description:
Jun 20 04:27:17 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.104 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:30:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195867&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929856 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:30:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984606&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781929857 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.146.172.113
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34-1024x461.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34-300x135.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34-768x346.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.34.webp 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.104.194
country_id: 6252001
description:
[2026-06-20 04:32:31 +0000] info [cpaneld] 82.40.104.194 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.118.60
country_id: 6252001
description:
[2026-06-20 04:33:06 +0000] info [cpaneld] 82.40.118.60 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.143.23
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL.jpg 1600w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-1024x682.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-1536x1023.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/03/dd443e682a7dcdea15176296aa1db883_XL-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [20/Jun/2026:04:34:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460615&pdata=http%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930077 HTTP/1.1" 302 0 sthandling-aero.tg "http://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [20/Jun/2026:04:35:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105384&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930134 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 04:35:37 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.105.21
country_id: 3469034
description:
Jun 20 04:36:18 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.105.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.105.21
country_id: 3469034
description:
Jun 20 04:36:33 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.105.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:36:39 +0000] info [cpaneld] 185.55.240.13 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.182
country_id: 3469034
description:
Jun 20 04:36:49 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jun 20 04:37:54 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:37:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.226.74
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1084471188 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:37:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313776&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930467 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302506&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930465 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.59.81.134
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/Diplomatie-Trois-nouveaux-ambassadeurs-accredites-au-Togo.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/10/Diplomatie-Trois-nouveaux-ambassadeurs-accredites-au-Togo-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/Diplomatie-Trois-nouveaux-ambassadeurs-accredites-au-Togo-768x615.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.215.139.227
country_id: 6252001
description:
[2026-06-20 04:44:28 +0000] info [cpaneld] 69.215.139.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.206.103.129
country_id: 6252001
description:
[2026-06-20 04:44:36 +0000] info [cpaneld] 72.206.103.129 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.118.106
country_id: 6252001
description:
[2026-06-20 04:44:39 +0000] info [cpaneld] 98.97.118.106 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 20 04:46:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:45:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922663&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930749 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:04:45:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526406&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781930749 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 20 04:45:55 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.44.213
country_id: 6252001
description:
[2026-06-20 04:48:12 +0000] info [cpaneld] 104.207.44.213 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-47.213.32.21.59||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.214.37.106
country_id: 2264397
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:181.214.37.106||TA:181.214.37.106||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.23.4
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39-1024x672.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39-300x197.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39-768x504.webp 768w, http:/togodailynews.tg/wp-content/uploads/2025/10/WhatsApp-Image-2025-10-15-at-14.39.39.webp 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:51:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:51:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.249.55.245
country_id: 1269750
description:
Jun 20 04:51:15 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.249.55.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 20 04:50:30 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.167.229.239
country_id: 1282988
description:
103.167.229.239 - - [20/Jun/2026:04:52:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382694&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Ffaure-gnassingbe-et-le-gouvernement-en-seminaire-a-kpalime&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931160 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/societe/faure-gnassingbe-et-le-gouvernement-en-seminaire-a-kpalime" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.167.229.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.247.246
country_id: 99237
description:
Jun 20 04:53:53 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.247.246 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:04:55:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069417&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931312 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:04:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923989&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931327 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 20 04:56:10 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 20 04:57:22 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:56:43 +0000] info [cpaneld] 185.55.240.13 - admin@togocarrierebetons.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 04:57:42 +0000] info [cpaneld] 185.55.240.13 - solarplusafrique.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user solarplusafrique.com (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.34
country_id: 2635167
description:
[2026-06-20 04:58:48 +0000] info [cpaneld] 5.230.133.34 NEW mbyqtkiw:4BtKHx3LggWZAqPI address=5.230.133.34,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:01:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804138&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931696 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:01:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985368&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781931696 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 20 05:03:26 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.141
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/Le-President-du-Conseil-Faure-Essozimna-Gnassingbe-a-recu-ce-18-mai-2026-une-delegation-ministerielle-polonaise-conduite-par-le-Vice-Premier-ministre-et-ministre-des-Affaires-numeriques.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/05/Le-President-du-Conseil-Faure-Essozimna-Gnassingbe-a-recu-ce-18-mai-2026-une-delegation-ministerielle-polonaise-conduite-par-le-Vice-Premier-ministre-et-ministre-des-Affaires-numeriques-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/Le-President-du-Conseil-Faure-Essozimna-Gnassingbe-a-recu-ce-18-mai-2026-une-delegation-ministerielle-polonaise-conduite-par-le-Vice-Premier-ministre-et-ministre-des-Affaires-numeriques-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.195.114.184
country_id: 6252001
description:
Jun 20 05:06:43 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.195.114.184 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:07:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:07:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:11:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383257&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932265 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:11:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869762&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932266 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.172.121.173
country_id: 3996063
description:
187.172.121.173 - - [20/Jun/2026:05:11:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6451097&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10934&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932283 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10934" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9787.1631 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.172.121.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jun 20 05:14:03 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.198.21
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-la-jeune-fille-est-bien-maintenue-dans-le-systeme-scolaire/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:15:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315886&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932550 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:15:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924969&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781932547 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.79.184.65
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3-1536x1152.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/10/Image-3.jpg 1600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.203
country_id: 3175395
description:
Jun 20 05:17:29 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.185
country_id: 1269750
description:
Jun 20 05:21:12 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.71.17.215
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-22.45.71.17.215||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:23:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:23:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.47.32.253
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1125820244 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.163.45
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.163.45
country_id: 290557
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.104.28.138
country_id: 1282988
description:
103.104.28.138 - - [20/Jun/2026:05:24:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054042&pdata=https%253A%252F%252Fcpanel.turkdef.free.netmaster.tg%252F%253Flocale%253Dko&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933095 HTTP/2.0" 302 0 cpanel.turkdef.free.netmaster.tg "https://cpanel.turkdef.free.netmaster.tg/?locale=ko" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.104.28.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.42.178.81
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/347504473 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-06-20 05:25:45 dovecot_plain authenticator failed for H=(autalia) [64.72.74.162]:51775: 535 Incorrect authentication data (set_id=57936965@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:25:49 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:11476: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.8
country_id: 2395170
description:
Jun 20 05:26:01 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:26:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711402&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933176 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:26:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119532&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933167 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.78.39.6
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/615863674 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.25.57.192
country_id: 3932488
description:
38.25.57.192 - - [20/Jun/2026:05:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104105&pdata=https%253A%252F%252Fcpanel.turkdef.free.netmaster.tg%252F%253Flocale%253Dfi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933266 HTTP/2.0" 302 0 cpanel.turkdef.free.netmaster.tg "https://cpanel.turkdef.free.netmaster.tg/?locale=fi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.25.57.192


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.53.240
country_id: 1269750
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/jzo-rain-2017/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:29:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935205&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933352 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:29:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119274&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933354 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 165.227.227.95
country_id: 2635167
description:
165.227.227.95 - - [20/Jun/2026:05:30:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853784&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYy5hb3VkZS5jQHJjdS5nb3Yuc2E%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781933402 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Yy5hb3VkZS5jQHJjdS5nb3Yuc2E=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:165.227.227.95


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:30:27 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:12953: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:31:31 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:9488: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-20 05:33:28 dovecot_plain authenticator failed for H=([192.168.1.72]) [102.64.164.199]:9971: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.222
country_id: 690791
description:
Jun 20 05:34:22 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.74
country_id: 3865483
description:
Jun 20 05:34:47 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.222
country_id: 690791
description:
Jun 20 05:34:28 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.33.241
country_id: 1269750
description:
Jun 20 05:35:01 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.33.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-06-20 05:35:03 dovecot_login authenticator failed for H=([125.17.70.25]) [128.185.33.241]:43719: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:38:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:38:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.7.71.181
country_id: 2750405
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 74.63.204.214
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:silasmessier189||Email:gseotier2@xmc.pl||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:42:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6383980&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934165 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:42:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247766&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934158 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 121.200.221.124
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/01/c9f88ad4007ec3ae53e51c9dece3e6a9_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2022/01/c9f88ad4007ec3ae53e51c9dece3e6a9_L-300x201.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/01/c9f88ad4007ec3ae53e51c9dece3e6a9_L-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.107
country_id: 3469034
description:
Jun 20 05:44:53 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 197.239.11.93
country_id: 226074
description:
[2026-06-20 05:45:31 +0000] info [cpaneld] 197.239.11.93 - pnls "POST /cpsess2500151008/3rdparty/phpMyAdmin/index.php?route=/ HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [197.239.9.110] != Current IP Address [197.239.11.93]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.190.194.14
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502-300x173.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502-768x443.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01502-1024x591.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:05:46:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604948&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934403 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-06-20 05:47:30 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl (fides217.static.host.gvt.net.br) [89.67.37.52]:57561: 535 Incorrect authentication data (set_id=phipa@centif.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-06-20 05:47:39 dovecot_login authenticator failed for H=([65.20.251.41]) [182.73.109.194]:34612: 535 Incorrect authentication data (set_id=phipa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.176
country_id: 6251999
description:
[2026-06-20 05:47:56 +0000] info [cpaneld] 217.181.81.176 - pmalabvi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.133.74.53
country_id: 2921044
description:
45.133.74.53 - ruuwezvf [20/Jun/2026:05:49:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092713&pdata=https%253A%252F%252Fmafisteel.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934573 HTTP/2.0" 302 0 mafisteel.tg "https://mafisteel.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.133.74.53


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.44.104.97
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1265786419 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:52:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:52:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.62.143
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/Celebration-du-64e-anniversaire-de-lindependance-le-chef-de-lEtat-a-preside-un-defile-militaire-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.239
country_id: 3469034
description:
Jun 20 05:55:09 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.239 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:05:56:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131605&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934976 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.12
country_id: 798544
description:
Jun 20 05:55:27 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.238.186
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/119388902 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:56:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800745&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934981 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:05:56:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935215&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781934989 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.201.87.172
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/7d6e79 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.168.112
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/464210875 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.33.130.102
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/fake_sign.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [20/Jun/2026:06:00:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841494&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935226 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.249.55.245
country_id: 1269750
description:
Jun 20 06:01:20 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.249.55.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:00:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066586&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935232 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:00:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261401&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935231 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.108.99
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1536x1024.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1.webp 1600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.41.178
country_id: 2077456
description:
2026-06-20 06:03:02 dovecot_login authenticator failed for H=110-175-41-178.static.tpgi.com.au ([111.70.34.159]) [110.175.41.178]:60017: 535 Incorrect authentication data (set_id=apoyo@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.34.84
country_id: 1835841
description:
Jun 20 06:03:17 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.34.84
country_id: 1835841
description:
2026-06-20 06:03:19 dovecot_login authenticator failed for H=([74.192.225.229]) [222.116.34.84]:58952: 535 Incorrect authentication data (set_id=apoyo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.62.144
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034.jpg 1560w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210703-WA0034-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.223.125.4
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1557927673 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:07:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:07:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.29.214.190
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c7c3c6 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.112.99.52
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210903-WA0142-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.209
country_id: 953987
description:
Jun 20 06:08:14 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.209 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [20/Jun/2026:06:08:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738435&pdata=http%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935716 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.148.161.154
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/a99b98 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-06-20 06:10:32 dovecot_login authenticator failed for H=([197.219.228.246]) [182.95.181.138]:38936: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.234.34.244
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/809395184 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:13:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081966&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781935993 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.104.224
country_id: 6252001
description:
[2026-06-20 06:14:25 +0000] info [cpaneld] 82.40.104.224 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:15:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844055&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936156 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:16:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854758&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936159 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.26.11.81
country_id: 6252001
description:
2026-06-20 06:18:23 dovecot_login authenticator failed for H=([14.51.223.171]) [2.26.11.81]:12480: 535 Incorrect authentication data (set_id=office@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.91.85
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/367103630 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.186.201.192
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/60738b-le-togo-et-la-banque-mondiale-scellent-le-financement-du-corridor-conomique-lom-ouagadougou-niamey-ocb-1.png 499w, http:/togodailynews.tg/wp-content/uploads/2021/10/60738b-le-togo-et-la-banque-mondiale-scellent-le-financement-du-corridor-conomique-lom-ouagadougou-niamey-ocb-1-300x200.png 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/60738b-le-togo-et-la-banque-mondiale-scellent-le-financement-du-corridor-conomique-lom-ouagadougou-niamey-ocb-1-272x182.png 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.191
country_id: 2017370
description:
2026-06-20 06:18:48 dovecot_login authenticator failed for H=78da6e9876c8.mldns.ru ([178.71.9.121]) [109.72.235.191]:60456: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.213.181.250
country_id: 6252001
description:
2026-06-20 06:19:03 dovecot_login authenticator failed for H=250.sub-97-213-181.myvzw.com ([111.70.34.159]) [97.213.181.250]:49782: 535 Incorrect authentication data (set_id=stephane.o)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.53.178.235
country_id: 2017370
description:
2026-06-20 06:18:32 dovecot_login authenticator failed for H=([197.167.169.179]) [95.53.178.235]:40620: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.70.207
country_id: 2017370
description:
2026-06-20 06:19:54 dovecot_login authenticator failed for H=([186.5.180.176]) [31.173.70.207]:29240: 535 Incorrect authentication data (set_id=admin@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.104.70.143
country_id: 2017370
description:
2026-06-20 06:20:04 dovecot_login authenticator failed for H=([41.70.94.2]) [212.104.70.143]:57834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-20 06:20:45 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.196.175.213
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1899440673 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.247
country_id: 690791
description:
Jun 20 06:22:45 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.193.164.206
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14-1024x663.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14-300x194.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14-768x497.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-03-at-11.52.14.webp 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:24:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:24:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.71.44
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/818688 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.66.184
country_id: 6252001
description:
[2026-06-20 06:27:48 +0000] info [cpaneld] 82.40.66.184 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:28:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382743&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936938 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:29:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7431835&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781936941 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:31:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792358&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937082 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:31:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542554&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937084 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 06:32:17 +0000] info [cpaneld] 185.55.240.13 - .SAPHYRTOUR "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.183.58.200
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/91867b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.4.144
country_id: 953987
description:
2026-06-20 06:33:59 dovecot_login authenticator failed for H=([203.110.89.205]) [154.73.4.144]:46193: 535 Incorrect authentication data (set_id=dnador@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.34.84
country_id: 1835841
description:
2026-06-20 06:34:28 dovecot_login authenticator failed for H=([183.171.49.144]) [222.116.34.84]:35381: 535 Incorrect authentication data (set_id=dnador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-06-20 06:36:02 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:50738: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.207.214
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2020/11/IMG-20201125-WA0060-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.79.249.33
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/10/eXgNVviq5wiNeYmBcDx5BamWpcYWrlop5qBt9PoJ.webp 824w, http:/togodailynews.tg/wp-content/uploads/2025/10/eXgNVviq5wiNeYmBcDx5BamWpcYWrlop5qBt9PoJ-300x196.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/10/eXgNVviq5wiNeYmBcDx5BamWpcYWrlop5qBt9PoJ-768x502.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.103.149
country_id: 2077456
description:
Jun 20 06:39:45 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.103.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.103.149
country_id: 2077456
description:
2026-06-20 06:39:47 dovecot_login authenticator failed for H=([170.39.151.178]) [58.84.103.149]:55233: 535 Incorrect authentication data (set_id=martine@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.122.32
country_id: 130758
description:
2026-06-20 06:40:01 dovecot_login authenticator failed for H=([119.51.237.123]) [213.176.122.32]:57566: 535 Incorrect authentication data (set_id=martine)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:39:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.176.122.32
country_id: 130758
description:
Jun 20 06:39:59 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.176.122.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:39:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.152.52.25
country_id: 2464461
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:257d03eb5416e9e51cc9c623ca1af6fcad319ad4||Title:5sbtnzgsl3i34lz84||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.141.91.2
country_id: 1835841
description:
2026-06-20 06:44:06 dovecot_login authenticator failed for H=([142.160.240.20]) [58.141.91.2]:54931: 535 Incorrect authentication data (set_id=serge.a@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.141.91.2
country_id: 1835841
description:
Jun 20 06:44:04 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.141.91.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.232.37.145
country_id: 1562822
description:
2026-06-20 06:44:16 dovecot_login authenticator failed for H=([5.135.202.77]) [14.232.37.145]:45683: 535 Incorrect authentication data (set_id=serge.a)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:45:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660051&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937917 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:45:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13342920&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937917 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:46:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264999&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937973 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.152.52.25
country_id: 2464461
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2b39602455af0f6199d71460ad173b5e0a1892c||Title:hzedlycdghzltg75||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:06:46:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804441&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781937972 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.237
country_id: 2395170
description:
Jun 20 06:48:07 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.50.106
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0007-696x608-1.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0007-696x608-1-300x262.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.167
country_id: 3469034
description:
Jun 20 06:49:03 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.152.30.75
country_id: 6252001
description:
[2026-06-20 06:49:24 +0000] info [cpaneld] 164.152.30.75 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.54.114
country_id: 226074
description:
Jun 20 06:49:25 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.54.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.54.114
country_id: 226074
description:
Jun 20 06:49:32 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.54.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.243
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2023\xc2\xa0: D\xc3\xa9but des luttes initiatiques en pr\xc3\xa9sence du chef de l\xe2\x80\x99\xc3\x89tat||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.127
country_id: 798544
description:
Jun 20 06:51:50 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.103.44
country_id: 798544
description:
Jun 20 06:52:26 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.103.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.86.108
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/colloque-scientifique-a-lome-medias-et-communication-pour-la-transition-ecologique/feed HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.116
country_id: 690791
description:
Jun 20 06:52:27 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.137.187
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0004-1-1024x768-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0004-1-1024x768-1-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2025/03/IMG-20250304-WA0004-1-1024x768-1-768x576.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 06:55:12 +0000] info [cpaneld] 185.55.240.13 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.251.86.65
country_id: 1210997
description:
Jun 20 06:57:02 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.251.86.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 88.238.192.5
country_id: 298795
domain: matwtogo.org
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:06:59:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459800&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938743 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:59:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248530&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938742 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.98.198.172
country_id: 290557
description:
92.98.198.172 - - [20/Jun/2026:06:59:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934187&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-letat-durgence-securitaire-proroge-dun-an-dans-la-region-des-savanes%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938763 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-letat-durgence-securitaire-proroge-dun-an-dans-la-region-des-savanes/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.98.198.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.236.98.157
country_id: 285570
description:
188.236.98.157 - - [20/Jun/2026:06:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380697&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-banque-centrale-de-tunisie-devient-le-treizieme-membre-du-papss&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938723 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-banque-centrale-de-tunisie-devient-le-treizieme-membre-du-papss" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.236.98.157


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-20 06:59:42 +0000] info [whostmgrd] 203.147.139.82 NEW root:uqVwwl7Dstq3P4xM address=203.147.139.82,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:_Oy0LhB9GoHskJ8u:create_user_session,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:06:59:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856618&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938762 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:01:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791843&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938871 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 157.66.87.98
country_id: 1643084
description:
157.66.87.98 - - [20/Jun/2026:07:00:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726402&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdemarrage-bientot-des-travaux-damenagement-de-la-depression-du-triangle-des-rails-a-tokoin-dogbeavou&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938852 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/demarrage-bientot-des-travaux-damenagement-de-la-depression-du-triangle-des-rails-a-tokoin-dogbeavou" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:157.66.87.98


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:01:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7377302&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781938870 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.11
country_id: 3469034
description:
Jun 20 07:02:45 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-20 07:04:28 +0000] info [whostmgrd] 203.147.139.82 NEW arsetg:ntcMn8aMMBZsUq39 address=203.147.139.82,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-20 07:04:29 +0000] info [cpaneld] 203.147.139.82 NEW arsetg:GrwacIDOp3sT9fUP address=203.147.139.82,app=cpaneld,creator=arsetg,method=handle_form_login,path=loadsession:arsetg:ntcMn8aMMBZsUq39,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.6.168
country_id: 3932488
description:
179.6.6.168 - - [20/Jun/2026:07:04:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987435&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-211009hetidm21twh.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939094 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nwyj-211009hetidm21twh.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.6.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.252.144.23
country_id: 1210997
description:
138.252.144.23 - - [20/Jun/2026:07:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803724&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fun-pretre-demissionne-par-amour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939148 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/un-pretre-demissionne-par-amour/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.8094.1129 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.252.144.23


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:10:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:10:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.181.219
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:rgph-5-sandra-ablamba-johnson-preside-une-reunion-devaluation-detape/||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.248.213
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-11.107.174.248.213||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.3.246.10
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-12.192.3.246.10||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 192.3.246.10
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:milagroscathey9||Email:richardmartin5314mwmj@a.travel-e-store.com||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:14:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261606&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939687 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001818&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939711 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671787&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781939687 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.181.201
country_id: 1861060
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:108.165.181.201||TA:108.165.181.201||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.120.12
country_id: 6252001
description:
[2026-06-20 07:19:24 +0000] info [cpaneld] 82.40.120.12 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:21:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:19557: 535 Incorrect authentication data (set_id=muszak)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-20 07:23:13 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.244
country_id: 2395170
description:
197.234.221.244 - - [20/Jun/2026:07:24:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327701&pdata=https%253A%252F%252Fdavakconsulting.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940245 HTTP/2.0" 302 0 davakconsulting.com "https://davakconsulting.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.234.221.244


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jun 20 07:26:21 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jun 20 07:26:27 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.43
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-28.148.222.185.43||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 07:28:44 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.203.44.26
country_id: 192950
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2018/01/Arr\xc3\xaat\xc3\xa9-MME-N\xc2\xb0007-AMPLI.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:28:46 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:12109: 535 Incorrect authentication data (set_id=adriel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:30:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235945&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940656 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:31:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790036&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940659 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:31:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393193&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940660 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.85
country_id: 3469034
description:
Jun 20 07:31:37 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.123.20
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1086477142 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.82.110
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202.webp 1600w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-1024x682.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2025/11/IMG-20251117-WA0202-1536x1023.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.132
country_id: 1814991
description:
2026-06-20 07:34:22 dovecot_login authenticator failed for H=(132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:49194: 535 Incorrect authentication data (set_id=info@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.123.90.154
country_id: 3865483
description:
190.123.90.154 - - [20/Jun/2026:07:34:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119064&pdata=https%253A%252F%252Fwebmail.ns1.netmaster.tg%252F%253Flocale%253Dsv&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781940862 HTTP/2.0" 302 0 webmail.ns1.netmaster.tg "https://webmail.ns1.netmaster.tg/?locale=sv" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.123.90.154


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 158.69.125.141
country_id: 6251999
domain: haplucia-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-20 07:34:24 +0000] info [cpaneld] 5.230.133.64 NEW wcnyaruu:fAcr1Oda4MIKarBD address=5.230.133.64,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.103.70.186
country_id: 1562822
description:
2026-06-20 07:35:05 dovecot_plain authenticator failed for H=(mduz3ogldeklj01g6cqlo9c7z0) [116.103.70.186]:36303: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:36:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:25426: 535 Incorrect authentication data (set_id=central)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.88.55.186
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bca999 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:37:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:37:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.196
country_id: 690791
description:
Jun 20 07:42:04 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 07:43:08 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:43:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:57239: 535 Incorrect authentication data (set_id=cptest)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:43:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133464&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941431 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:44:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608854&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941453 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.2.178
country_id: 6252001
domain: soena.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/soena.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.105
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:premier-seminaire-gouvernemental-lexecutif-en-conclave-pour-definir-ses-orientations/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:44:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000022&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941435 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.129.94
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-45.191.102.129.94||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.25
country_id: 6252001
description:
205.169.39.25 - - [20/Jun/2026:07:47:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081706&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941638 HTTP/1.1" 302 0 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.25


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 07:47:26 +0000] info [cpaneld] 185.55.240.13 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.16
country_id: 2750405
description:
2026-06-20 07:50:07 dovecot_plain authenticator failed for H=(v8z710656hfok3a7j) [192.42.116.16]:45503: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 49.48.250.209
country_id: 1605651
description:
49.48.250.209 - - [20/Jun/2026:07:50:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6868118&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F13668&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781941801 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/13668" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:49.48.250.209


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.2.50
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1680340185 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:50:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:17724: 535 Incorrect authentication data (set_id=jaimie)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:51:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:51:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.169.21.120
country_id: 3469034
description:
Jun 20 07:52:41 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.169.21.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.206.73
country_id: 690791
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?trk=organization_guest_main-feed-card-text HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.206.73
country_id: 690791
domain: www.arse.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tghttp/www.arse.tg/?trk=organization_guest_main-feed-card-text HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.45.123
country_id: 2542007
description:
2026-06-20 07:55:00 dovecot_plain authenticator failed for H=adsl196-123-45-206-196.adsl196-2.iam.net.ma (w0fuo6djy8rvt5p75x) [196.206.45.123]:53875: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.209
country_id: 953987
description:
Jun 20 07:55:48 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.39.11.242
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/03/neuf-nouveaux-ambassadeurs.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2021/03/neuf-nouveaux-ambassadeurs-300x201.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/03/neuf-nouveaux-ambassadeurs-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 07:57:20 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:58:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872302&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942287 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:07:58:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869469&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942306 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:07:58:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263396&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942287 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 07:57:33 ns5 auth[288536]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 07:57:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:26791: 535 Incorrect authentication data (set_id=kawano)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:07:58:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117827&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942311 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.226.34.19
country_id: 3017382
description:
[2026-06-20 08:01:04 +0000] info [cpaneld] 185.226.34.19 NEW conforwellty:JAOnYR3aYkM93j1y address=185.226.34.19,app=cpaneld,creator=conforwellty,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-20 08:01:22 +0000] info [cpaneld] 103.77.107.71 - @ "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.163.245.23
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/05/kkk-1.webp 945w, http:/togodailynews.tg/wp-content/uploads/2025/05/kkk-1-300x226.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/05/kkk-1-768x579.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 08:06:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:15284: 535 Incorrect authentication data (set_id=luke)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 08:06:20 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.156
country_id: 1880251
description:
43.173.178.156 - - [20/Jun/2026:08:07:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249882&pdata=https%253A%252F%252F24heureinfo.tg%252Fflash-info%252Fle-togo-bientot-connecte-au-starlink-delon-musk%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942833 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/flash-info/le-togo-bientot-connecte-au-starlink-delon-musk/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.156


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:07:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:07:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.191.73
country_id: 2245662
domain: www.togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.togodailynews.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.191.73
country_id: 2245662
domain: www.togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.togodailynews.tghttp/www.togodailynews.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.3.68.121
country_id: 1643084
description:
182.3.68.121 - - [20/Jun/2026:08:08:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661340&pdata=http%253A%252F%252Ftogodailynews.tg%252Ffocac2024-faure-gnassingbe-echange-avec-les-responsables-du-pcc&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781942932 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/focac2024-faure-gnassingbe-echange-avec-les-responsables-du-pcc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.3.68.121


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.129.134
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-14.191.102.129.134||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:08:13:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12830821&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781943222 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 08:14:20 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:46240: 535 Incorrect authentication data (set_id=sikora)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:13:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014933&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781943219 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jun 20 08:16:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.103.54.253
country_id: 2921044
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47647.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97ce8c2502f46b4548cf6c337217e99bfa3c3382||Title:nmmv327apfwpecjr||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 86.103.54.253
country_id: 2921044
domain: arse.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.030951905303749694||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.57
country_id: 690791
description:
Jun 20 08:18:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.57 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:21:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:21:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 20 08:21:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-20 08:21:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:27594: 535 Incorrect authentication data (set_id=teodor)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.135
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-21.206.232.2.135||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.64.216
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8d8a84 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.13.143
country_id: 6252001
domain: atms.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/atms.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:28:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170463&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944088 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:08:28:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789531&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944091 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:08:29:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607624&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944196 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:30:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143902&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944199 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 20 08:30:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77277976
name: IM360 WAF: XMLRPC getUsersBlogs RBL infectors
abuser: 146.70.202.54
country_id: 6252001
domain: togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL infectors||Username:turboOMSA1494.togosem.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [20/Jun/2026:08:32:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7364971&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944375 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.66.28
country_id: 6252001
description:
[2026-06-20 08:33:15 +0000] info [cpaneld] 82.40.66.28 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.209.229.158
country_id: 597427
description:
[2026-06-20 08:33:53 +0000] info [cpaneld] 80.209.229.158 NEW wcnyaruu:O7jvuhmzloVFZ6r9 address=80.209.229.158,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.130.110
country_id: 2363686
description:
102.64.130.110 - - [20/Jun/2026:08:34:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6463341&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fsoja%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944455 HTTP/2.0" 302 0 direct7.tg "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.6670.55 Safari/537.36 OPR/86.0.3852.88" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.130.110


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 102.64.130.110
country_id: 2363686
description:
102.64.130.110 - - [20/Jun/2026:08:34:56 +0000] "GET /tag/soja/ HTTP/2.0" 499 0 direct7.tg "https://direct7.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6463341&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fsoja%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944455" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.6670.55 Safari/537.36 OPR/86.0.3852.88" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.130.110


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:37:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.254.170.15
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/635455 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:36:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.42.198
country_id: 6252001
description:
[2026-06-20 08:37:32 +0000] info [cpaneld] 104.207.42.198 - waywcbyw "POST /execute/Variables/get_session_information HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.93.168.106
country_id: 783754
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/nouvelle-gamme-de-produits HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.226.149.64
country_id: 3932488
description:
38.226.149.64 - - [20/Jun/2026:08:41:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067374&pdata=https%253A%252F%252Feducplusmedia.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944859 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.226.149.64


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066536&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781944906 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.141.33
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068-300x160.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068-1024x546.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068-768x410.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260618-WA0068.webp 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.135.166
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/acheter-sa-premiere-pharmacie-les-points-cles-2.webp 1000w, http:/togodailynews.tg/wp-content/uploads/2025/11/acheter-sa-premiere-pharmacie-les-points-cles-2-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/11/acheter-sa-premiere-pharmacie-les-points-cles-2-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:44:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656872&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945080 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:08:44:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259287&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945084 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.113.215.171
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060.webp 1040w, http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/02/IMG-20230925-WA0060-768x576.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:52:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:52:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-20 08:55:10 +0000] info [cpaneld] 5.230.153.156 NEW ttfuehop:LalFo8tsX3Q2tlwg address=5.230.153.156,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.85
country_id: 3469034
description:
Jun 20 08:55:20 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.176
country_id: 3175395
description:
Jun 20 08:55:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.194.89.150
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/05/Dr.-Ndiame-Diop-World-Bank-Country-Director-for-Nigeria.webp 900w, http:/togodailynews.tg/wp-content/uploads/2025/05/Dr.-Ndiame-Diop-World-Bank-Country-Director-for-Nigeria-300x165.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/05/Dr.-Ndiame-Diop-World-Bank-Country-Director-for-Nigeria-768x423.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:57:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050599&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945852 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:08:57:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118228&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945853 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.238
country_id: 226074
description:
Jun 20 08:59:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.238 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:08:59:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936232&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781945984 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:00:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801509&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946003 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.248
country_id: 3469034
description:
Jun 20 09:02:51 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 09:04:22 +0000] info [cpaneld] 185.55.240.13 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.101.190.45
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006.jpg 869w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006-768x513.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211029-WA0006-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.122.242.123
country_id: 3686110
description:
185.122.242.123 - - [20/Jun/2026:09:05:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001093&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Frecensement-dans-la-zone-2-les-crv-souvrent-de-7-a-17-heures-rappelle-la-ceni&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946324 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/recensement-dans-la-zone-2-les-crv-souvrent-de-7-a-17-heures-rappelle-la-ceni" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.122.242.123


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.119.135
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/11/t\xc3\xa9l\xc3\xa9chargement-27.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2021/11/t\xc3\xa9l\xc3\xa9chargement-27-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:09:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:09:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.119.173
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/jeu-concours-capsule-2023 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:11:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246487&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946714 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:11:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947497&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946716 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.11
country_id: 3865483
description:
Jun 20 09:12:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 09:13:04 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.154.42.198
country_id: 6252001
description:
[2026-06-20 09:13:08 +0000] info [cpaneld] 162.154.42.198 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.248.135
country_id: 6252001
description:
[2026-06-20 09:14:00 +0000] info [cpaneld] 76.35.248.135 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.87.197.113
country_id: 6252001
description:
[2026-06-20 09:13:41 +0000] info [cpaneld] 23.87.197.113 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.133.32.204
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-B.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-B-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-2-B-768x614.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:14:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055833&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946874 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:14:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739363&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781946875 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.131.146.49
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit.jpg 1220w, http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit-300x205.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit-1024x699.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/05/2024-Africa-Fertilizer-and-Soil-Health-Summit-768x524.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.90
country_id: 3469034
description:
Jun 20 09:22:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.231.252.223
country_id: 285570
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/5c524b HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.199.110.49
country_id: 1210997
description:
103.199.110.49 - - [20/Jun/2026:09:21:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922200&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fmodernisation-des-medias-au-togo-le-prof-prof-akodah-ayewouadan-receptionne-un-lot-de-materiel-dun-montant-de-62-millions-fcfa%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947302 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Fmodernisation-des-medias-au-togo-le-prof-prof-akodah-ayewouadan-receptionne-un-lot-de-materiel-dun-montant-de-62-millions-fcfa%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.199.110.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.191.25.99
country_id: 1562822
description:
14.191.25.99 - - [20/Jun/2026:09:22:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857171&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252F67-ans-au-service-de-lhumanite&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947369 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/67-ans-au-service-de-lhumanite" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.191.25.99


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.215.106
country_id: 3469034
description:
2026-06-20 09:23:18 dovecot_login authenticator failed for H=(45-181-215-106.brasnetinformatica.com.br.215.181.45.in-addr.arpa) [45.181.215.106]:52453: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:23:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-06-20 09:23:40 +0000] info [cpaneld] 134.195.82.68 NEW mbyqtkiw:lXahRqB6GxqFLo16 address=134.195.82.68,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:23:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.14.10
country_id: 226074
description:
Jun 20 09:27:22 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.14.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081034&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947666 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:27:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055319&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947665 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.14.10
country_id: 226074
description:
Jun 20 09:27:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.14.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.176
country_id: 3469034
description:
Jun 20 09:27:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:29:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116952&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947777 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:29:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841961&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947767 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:09:29:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183068&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947770 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.243.112
country_id: 798544
description:
Jun 20 09:32:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.243.112 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.38.42.66
country_id: 290557
description:
5.38.42.66 - - [20/Jun/2026:09:36:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842730&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fsante%25252Fcoronavirus-les-ministres-de-la-sante-de-luemoa-en-conclave-jeudi%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948172 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fsante%2Fcoronavirus-les-ministres-de-la-sante-de-luemoa-en-conclave-jeudi%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.38.42.66


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:38:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:38:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.19
country_id: 6252001
description:
[2026-06-20 09:39:57 +0000] info [cpaneld] 64.44.59.19 NEW formationfreenet:LCKSEWZmoK2VHP3O address=64.44.59.19,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:09:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591844&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948500 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/index.php?cmd=newupld" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.124
country_id: 953987
description:
Jun 20 09:41:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.124 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:42:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515303&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948527 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:42:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181258&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948529 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.110.182
country_id: 6252001
description:
[2026-06-20 09:44:39 +0000] info [cpaneld] 82.40.110.182 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.139.254.141
country_id: 1282988
description:
103.139.254.141 - - [20/Jun/2026:09:46:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674134&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fdio%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948759 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/dio/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.139.254.141


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.19.181.244
country_id: 1694008
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-45.113.19.181.244||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:09:45:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277086&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948732 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:45:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923019&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948731 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:45:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514842&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948728 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.233.161
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/IMG_1504.webp 1000w, http:/togodailynews.tg/wp-content/uploads/2026/03/IMG_1504-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/03/IMG_1504-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.38.58.194
country_id: 290557
description:
5.38.58.194 - - [20/Jun/2026:09:52:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117159&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Ftarifs-mobiles%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949121 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/tarifs-mobiles/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.38.58.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 09:51:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.197
country_id: 690791
description:
Jun 20 09:52:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.8.122.120
country_id: 6252001
description:
2026-06-20 09:52:45 dovecot_login authenticator failed for H=(localhost.localdomain) [96.8.122.120]:34272: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:55:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:55:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:57:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869420&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949471 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:57:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737875&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949474 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.18.204
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a756a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:59:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805465&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949567 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:59:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278313&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949570 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.73.138.122
country_id: 953987
description:
Jun 20 10:01:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.73.138.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 10:02:00 +0000] info [cpaneld] 103.253.27.219 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.201.53.135
country_id: 6252001
description:
[2026-06-20 10:02:33 +0000] info [cpaneld] 44.201.53.135 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.61.156
country_id: 6252001
description:
2026-06-20 10:03:42 dovecot_login authenticator failed for H=wsip-68-225-61-156.pn.at.cox.net ([95.52.194.27]) [68.225.61.156]:58505: 535 Incorrect authentication data (set_id=afford@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.163
country_id: 3469034
description:
Jun 20 10:03:51 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.19.19.69
country_id: 1643084
description:
160.19.19.69 - - [20/Jun/2026:10:04:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051666&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fgunn-edoe%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949851 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/gunn-edoe/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.19.19.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jun 20 10:03:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.199.197.255
country_id: 2017370
description:
Jun 20 10:08:56 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.199.197.255 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:09:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:09:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:10:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144152&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950251 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:10:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525842&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950253 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:10:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843593&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950410 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:10:13:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792155&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950411 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:13:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946214&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950411 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.194.172
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:afreximbank-nomme-haytham-el-maayergi-au-poste-de-vice-president-executif-de-global-trade-bank-evp-gtba/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.243.58
country_id: 1814991
description:
Jun 20 10:15:51 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.243.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.85.184
country_id: 6252001
description:
[2026-06-20 10:15:57 +0000] info [cpaneld] 82.40.85.184 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.98.176
country_id: 2589581
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=10.2.2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.108.142
country_id: 953987
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/01/Convergence-de-vues-entre-le-Togo-et-le-Qatar-pour-une-solution-durable-a-la-crise-dans-la-region-des-Grands-Lacs-768x536.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.101.188
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 32 sur 453&siteId=1&rec=1&rand=342753&h=18&m=18&s=7&url=http:/togodailynews.tg/author/admin/page/32/&uid=0&pid=0&visitorId=a5eb79a2dea218a2&fvts=1781950688&vc=1&idn=0&refts=0&lvts=1781950688&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3527&pvId=G4198H&browser=Chrome_59&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.57.26
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.57.26
country_id: 2328926
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/author/togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.179
country_id: 3469034
description:
Jun 20 10:20:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.133.218
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 37 sur 453&siteId=1&rec=1&rand=542363&h=18&m=22&s=4&url=http:/togodailynews.tg/author/admin/page/37/&uid=0&pid=0&visitorId=f568d43d0279106c&fvts=1781950925&vc=1&idn=0&refts=0&lvts=1781950925&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=8616&pvId=J7pzsr&browser=Chrome_45&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.208.105
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/css/swiper-bundle.min.css?ver=1.0.0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.95.174
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=824619&h=18&m=22&s=34&url=http:/togodailynews.tg/author/admin/page/37/&uid=0&pid=0&visitorId=f568d43d0279106c&fvts=1781950925&vc=1&idn=0&refts=0&lvts=1781950925&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=8616&pvId=J7pzsr&browser=Chrome_45&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.93
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-23.206.232.2.93||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 10:22:28 +0000] info [cpaneld] 185.55.240.13 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.83.40.117
country_id: 1643084
description:
203.83.40.117 - - [20/Jun/2026:10:23:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052142&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F39%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951017 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/39/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5011.1922 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.83.40.117


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:24:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 10:24:32 +0000] info [cpaneld] 185.55.240.13 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:24:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.57
country_id: 1880251
description:
47.128.121.57 - - [20/Jun/2026:10:25:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998952&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F42%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951157 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/42/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.130
country_id: 6290252
description:
Jun 20 10:25:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.23
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2025/12/Faure-Gnassingbe.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 10:26:51 +0000] info [cpaneld] 103.253.27.219 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:27:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378274&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951221 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:27:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328428&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951223 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:28:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004444&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951300 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:10:28:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791433&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951300 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:10:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923220&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951311 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132639&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951308 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [20/Jun/2026:10:29:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135762&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F48%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951368 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/48/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.57
country_id: 1880251
description:
47.128.121.57 - - [20/Jun/2026:10:31:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157834&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F51%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951473 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/51/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.57


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-20 10:31:06 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.106.73
country_id: 3469034
description:
Jun 20 10:31:14 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.106.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.124.23.165
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.115.129
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1327934794 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.14.227
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/716964 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.254.224.164
country_id: 1880251
description:
[2026-06-20 10:39:15 +0000] info [cpaneld] 54.254.224.164 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 178.92.9.2
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-togo-ne-veut-pas-dun-systeme-educatif-depourvu-dinfrastructures/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:40:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 10:41:42 +0000] info [cpaneld] 152.42.200.110 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.157.233.28
country_id: 6252001
description:
2026-06-20 10:41:45 dovecot_plain authenticator failed for H=ec2-54-157-233-28.compute-1.amazonaws.com (EC2AMAZ-S0IK57A.ec2.internal) [54.157.233.28]:62005: 535 Incorrect authentication data (set_id=mawinaoui@primuscourtier.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.157.233.28
country_id: 6252001
description:
Jun 20 10:41:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.157.233.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:42:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749603&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952124 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:42:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10133144&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952125 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:10:44:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924757&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952286 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:44:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092761&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952291 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.11.54
country_id: 3469034
description:
Jun 20 10:44:56 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.11.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.69.185
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 67 sur 453&siteId=1&rec=1&rand=093642&h=18&m=45&s=17&url=http:/togodailynews.tg/author/admin/page/67/&uid=0&pid=0&visitorId=99adb57cfa03625b&fvts=1781952317&vc=1&idn=0&refts=0&lvts=1781952317&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=5402&pvId=PmVrQL&browser=Chrome_43&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:10:44:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327498&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952279 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 10:47:20 +0000] info [cpaneld] 185.55.240.13 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.203
country_id: 3865483
description:
Jun 20 10:47:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.203
country_id: 3865483
description:
Jun 20 10:47:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-06-20 10:47:32 +0000] info [cpaneld] 144.91.125.41 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.9
country_id: 690791
description:
Jun 20 10:47:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jun 20 10:47:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.135.215
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/cgi-bin/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.232.225.54
country_id: 597427
description:
2026-06-20 10:48:37 dovecot_login authenticator failed for H=host-94-232-225-54.etanetas.lt [94.232.225.54]:40914: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.150.95
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=N;O=D HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.235.228
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=M;O=A HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.104.123.69
country_id: 2589581
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=S;O=A HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.104.27
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=D;O=A HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.68
country_id: 3175395
description:
Jun 20 10:49:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.70.18
country_id: 3057568
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 74 sur 453&siteId=1&rec=1&rand=489647&h=18&m=49&s=51&url=http:/togodailynews.tg/author/admin/page/74/&uid=0&pid=0&visitorId=14c929ce9446ffae&fvts=1781952591&vc=1&idn=0&refts=0&lvts=1781952591&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=4615&pvId=bedNc0&browser=Chrome_40&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.34.189.57
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/linquietante-montee-en-puissance-des-ultra-riches-a-davos-750x375-1.webp 750w, http:/togodailynews.tg/wp-content/uploads/2026/01/linquietante-montee-en-puissance-des-ultra-riches-a-davos-750x375-1-300x150.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.68.49.235
country_id: 2921044
description:
Jun 20 10:54:09 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.68.49.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-20 10:55:19 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:55:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:56:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738183&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952972 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.65.201.146
country_id: 6252001
description:
[2026-06-20 10:56:20 +0000] info [cpaneld] 20.65.201.146 - AWADI "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.59.106
country_id: 2328926
description:
[2026-06-20 10:55:33 +0000] info [webmaild] 197.211.59.106 - anticorruption@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [20/Jun/2026:10:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935209&pdata=http%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F81%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952934 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/author/admin/page/81/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:56:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516074&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952974 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.165.232.52
country_id: 1562822
description:
14.165.232.52 - - [20/Jun/2026:10:56:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065518&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-mois-du-consommer-local-une-troisieme-edition-pleine-despoirs-pour-les-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953005 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-mois-du-consommer-local-une-troisieme-edition-pleine-despoirs-pour-les-togolais/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2363.1887 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.165.232.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.120.51.251
country_id: 2635167
description:
[2026-06-20 10:58:29 +0000] info [whostmgrd] 31.120.51.251 - benito10 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.146.178
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/239886239 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.248.250
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-1024x819.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-768x614.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-1536x1229.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-2048x1638.jpg 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116653&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953210 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:00:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016686&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953214 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:11:00:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118598&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953213 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.109.240
country_id: 2400553
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/efd6d0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.133.222.75
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I.webp 1199w, http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.27
country_id: 3175395
description:
209.227.239.27 - - [20/Jun/2026:11:01:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012825&pdata=https%253A%252F%252Fmyworkafrica.com%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953305 HTTP/2.0" 302 0 myworkafrica.com "https://myworkafrica.com/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.27


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:11:02:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382949&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953344 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.111
country_id: 6252001
description:
[2026-06-20 11:01:43 +0000] info [whostmgrd] 195.63.9.111 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.221.154
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/c8d7ea8af6aec31c4a276aede1d6de74_XL.webp 471w, http:/togodailynews.tg/wp-content/uploads/2025/11/c8d7ea8af6aec31c4a276aede1d6de74_XL-300x185.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.24.148.121
country_id: 2017370
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/4c5e7a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.166.242.236
country_id: 6252001
description:
35.166.242.236 - - [20/Jun/2026:11:05:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949653&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252F714c81ee2d0a7acc45a6c14cc2395b67%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953506 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/714c81ee2d0a7acc45a6c14cc2395b67/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.166.242.236


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-20 11:06:35 +0000] info [cpaneld] 181.113.114.61 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.157.112.202
country_id: 3017382
domain: mesyscom.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:jmtctoni||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.81
country_id: 1880251
description:
47.128.121.81 - - [20/Jun/2026:11:08:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924965&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F98%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953709 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/98/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.81


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.166.242.236
country_id: 6252001
description:
35.166.242.236 - - [20/Jun/2026:11:09:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921361&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953773 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.166.242.236


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:10:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001506&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953805 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:10:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659179&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953804 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.150.85
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/Les-grandes-decisions-du-Conseil-des-ministres-du-19-fevrier-2026-photo-archives.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/02/Les-grandes-decisions-du-Conseil-des-ministres-du-19-fevrier-2026-photo-archives-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/Les-grandes-decisions-du-Conseil-des-ministres-du-19-fevrier-2026-photo-archives-768x576.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:11:11:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725333&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F3ab2e605cafab0f046b95d461a96be5c%252F66fe440de5c3e86a03793c42215f2f04%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953858 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/3ab2e605cafab0f046b95d461a96be5c/66fe440de5c3e86a03793c42215f2f04/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:11:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:11:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.170
country_id: 6252001
description:
2026-06-20 11:11:51 dovecot_login authenticator failed for H=(dG1tqm) [191.101.61.170]:62728: 535 Incorrect authentication data (set_id=httpcafelabo.tgstephane.o@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:12:46 dovecot_login authenticator failed for H=(oPDXmBpZha) [60.191.91.122]:2550: 535 Incorrect authentication data (set_id=aitogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:13:59 dovecot_login authenticator failed for H=(44yyCxzs) [60.191.91.122]:2854: 535 Incorrect authentication data (set_id=aitogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:14:48 dovecot_login authenticator failed for H=(uAZ1Ymq) [60.191.91.122]:4312: 535 Incorrect authentication data (set_id=aitogo)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.213.86
country_id: 2363686
description:
[2026-06-20 11:15:07 +0000] info [webmaild] 196.168.213.86 - kakue@togointerim.net "POST /cpsess0956995836/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [196.168.213.86]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans un contexte o\xc3\xb9 les initiatives citoyennes gagnent en ampleur et en impact, la reconnaissance accord\xc3\xa9e \xc3\xa0 la faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement \xe2\x80\x93 lors de la soir\xc3\xa9e de transformation organis\xc3\xa9e par yals vient consacrer un engagement de terrain constant en faveur de l\xe2\x80\x99eau, de l\xe2\x80\x99assainissement et du bien-\xc3\xaatre communautaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le 06 juin dernier, cette distinction a mis en lumi\xc3\xa8re le r\xc3\xb4le strat\xc3\xa9gique jou\xc3\xa9 par l\xe2\x80\x99organisation dans l\xe2\x80\x99am\xc3\xa9lioration des conditions de vie des populations. \xc3\x80 travers ses actions, la faea s\xe2\x80\x99impose progressivement comme un acteur incontournable dans la promotion de solutions durables pour des communaut\xc3\xa9s plus saines, plus r\xc3\xa9silientes et mieux structur\xc3\xa9es face aux d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette reconnaissance intervient dans un cadre symbolique fort, celui de la soir\xc3\xa9e de transformation de young african leaders speakers (yals), plateforme engag\xc3\xa9e dans la valorisation du leadership des jeunes et la r\xc3\xa9v\xc3\xa9lation des potentiels \xc3\xa9mergents. l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a ainsi servi de vitrine \xc3\xa0 des initiatives porteuses de changement et d\xe2\x80\x99innovation sociale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>lire aussi</strong> :<strong> <a href=\"https://leadelles.tg/index.php/2026/06/20/leadership-feminin-au-sommet-de-la-finance-togolaise-estelle-fafa-akue-komlan-une-ascension-qui-redefinit-les-codes-bancaires/\">leadership f\xc3\xa9minin au sommet de la finance togolaise : estelle fafa akue komlan, une ascension qui red\xc3\xa9finit les codes bancaires</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":912,\"width\":\"840px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/faea-683x1024.jpg\" alt=\"\" class=\"wp-image-912\" style=\"width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9agissant \xc3\xa0 cette distinction, la pr\xc3\xa9sidente de la faea a exprim\xc3\xa9 sa gratitude avec des mots empreints de conviction et de reconnaissance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>\xc2\xab nous adressons nos sinc\xc3\xa8res remerciements \xc3\xa0 yals (young african leaders speakers) pour cette distinction ainsi que pour sa mission de transformation, de r\xc3\xa9v\xc3\xa9lation des potentiels et de promotion du leadership des jeunes \xc2\xbb, a d\xc3\xa9clar\xc3\xa9 carole aghey, pr\xc3\xa9sidente de faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l\xe2\x80\x99hommage, cette distinction appara\xc3\xaet comme un signal fort en faveur de la consolidation des initiatives citoyennes f\xc3\xa9minines dans les secteurs essentiels du d\xc3\xa9veloppement. elle souligne \xc3\xa9galement l\xe2\x80\x99importance des synergies entre organisations engag\xc3\xa9es pour amplifier l\xe2\x80\x99impact social.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans cette dynamique, la faea entend poursuivre son action avec d\xc3\xa9termination, convaincue que l\xe2\x80\x99engagement citoyen, le leadership et l\xe2\x80\x99action communautaire constituent des leviers essentiels de transformation durable des soci\xc3\xa9t\xc3\xa9s.</p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:11:16:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841702&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F475cbf0e239ed73967d9e29c88977295%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954158 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/475cbf0e239ed73967d9e29c88977295/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:16:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064487&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954160 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.9.128
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/693724802 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:11:16:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003411&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954157 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:16:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443860&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954160 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.47.42.43
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a3a0a3 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:15:38 dovecot_login authenticator failed for H=(eOTi58) [60.191.91.122]:4893: 535 Incorrect authentication data (set_id=aitogo)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans un contexte o\xc3\xb9 les initiatives citoyennes gagnent en ampleur et en impact, la reconnaissance accord\xc3\xa9e \xc3\xa0 la faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement \xe2\x80\x93 lors de la soir\xc3\xa9e de transformation organis\xc3\xa9e par yals vient consacrer un engagement de terrain constant en faveur de l\xe2\x80\x99eau, de l\xe2\x80\x99assainissement et du bien-\xc3\xaatre communautaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le 06 juin dernier, cette distinction a mis en lumi\xc3\xa8re le r\xc3\xb4le strat\xc3\xa9gique jou\xc3\xa9 par l\xe2\x80\x99organisation dans l\xe2\x80\x99am\xc3\xa9lioration des conditions de vie des populations. \xc3\x80 travers ses actions, la faea s\xe2\x80\x99impose progressivement comme un acteur incontournable dans la promotion de solutions durables pour des communaut\xc3\xa9s plus saines, plus r\xc3\xa9silientes et mieux structur\xc3\xa9es face aux d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette reconnaissance intervient dans un cadre symbolique fort, celui de la soir\xc3\xa9e de transformation de young african leaders speakers (yals), plateforme engag\xc3\xa9e dans la valorisation du leadership des jeunes et la r\xc3\xa9v\xc3\xa9lation des potentiels \xc3\xa9mergents. l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a ainsi servi de vitrine \xc3\xa0 des initiatives porteuses de changement et d\xe2\x80\x99innovation sociale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":912,\"width\":\"840px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/faea-683x1024.jpg\" alt=\"\" class=\"wp-image-912\" style=\"width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9agissant \xc3\xa0 cette distinction, la pr\xc3\xa9sidente de la faea a exprim\xc3\xa9 sa gratitude avec des mots empreints de conviction et de reconnaissance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>\xc2\xab nous adressons nos sinc\xc3\xa8res remerciements \xc3\xa0 yals (young african leaders speakers) pour cette distinction ainsi que pour sa mission de transformation, de r\xc3\xa9v\xc3\xa9lation des potentiels et de promotion du leadership des jeunes \xc2\xbb, a d\xc3\xa9clar\xc3\xa9 carole aghey, pr\xc3\xa9sidente de faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>lire aussi</strong> :<strong><a href=\"https://leadelles.tg/index.php/2026/06/20/leadership-feminin-au-sommet-de-la-finance-togolaise-estelle-fafa-akue-komlan-une-ascension-qui-redefinit-les-codes-bancaires/\">leadership f\xc3\xa9minin au sommet de la finance togolaise : estelle fafa akue komlan, une ascension qui red\xc3\xa9finit les codes bancaires</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l\xe2\x80\x99hommage, cette distinction appara\xc3\xaet comme un signal fort en faveur de la consolidation des initiatives citoyennes f\xc3\xa9minines dans les secteurs essentiels du d\xc3\xa9veloppement. elle souligne \xc3\xa9galement l\xe2\x80\x99importance des synergies entre organisations engag\xc3\xa9es pour amplifier l\xe2\x80\x99impact social.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans cette dynamique, la faea entend poursuivre son action avec d\xc3\xa9termination, convaincue que l\xe2\x80\x99engagement citoyen, le leadership et l\xe2\x80\x99action communautaire constituent des leviers essentiels de transformation durable des soci\xc3\xa9t\xc3\xa9s.</p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.67.44
country_id: 1733045
description:
180.74.67.44 - - [20/Jun/2026:11:16:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079750&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Fdiplomatie-deux-nouveaux-ambassadeurs-accredites-au-togo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954198 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/diplomatie/diplomatie-deux-nouveaux-ambassadeurs-accredites-au-togo" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.67.44


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans un contexte o\xc3\xb9 les initiatives citoyennes gagnent en ampleur et en impact, la reconnaissance accord\xc3\xa9e \xc3\xa0 la faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement \xe2\x80\x93 lors de la soir\xc3\xa9e de transformation organis\xc3\xa9e par yals vient consacrer un engagement de terrain constant en faveur de l\xe2\x80\x99eau, de l\xe2\x80\x99assainissement et du bien-\xc3\xaatre communautaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le 06 juin dernier, cette distinction a mis en lumi\xc3\xa8re le r\xc3\xb4le strat\xc3\xa9gique jou\xc3\xa9 par l\xe2\x80\x99organisation dans l\xe2\x80\x99am\xc3\xa9lioration des conditions de vie des populations. \xc3\x80 travers ses actions, la faea s\xe2\x80\x99impose progressivement comme un acteur incontournable dans la promotion de solutions durables pour des communaut\xc3\xa9s plus saines, plus r\xc3\xa9silientes et mieux structur\xc3\xa9es face aux d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette reconnaissance intervient dans un cadre symbolique fort, celui de la soir\xc3\xa9e de transformation de young african leaders speakers (yals), plateforme engag\xc3\xa9e dans la valorisation du leadership des jeunes et la r\xc3\xa9v\xc3\xa9lation des potentiels \xc3\xa9mergents. l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a ainsi servi de vitrine \xc3\xa0 des initiatives porteuses de changement et d\xe2\x80\x99innovation sociale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":912,\"width\":\"840px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/faea-683x1024.jpg\" alt=\"\" class=\"wp-image-912\" style=\"width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9agissant \xc3\xa0 cette distinction, la pr\xc3\xa9sidente de la faea a exprim\xc3\xa9 sa gratitude avec des mots empreints de conviction et de reconnaissance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>\xc2\xab nous adressons nos sinc\xc3\xa8res remerciements \xc3\xa0 yals (young african leaders speakers) pour cette distinction ainsi que pour sa mission de transformation, de r\xc3\xa9v\xc3\xa9lation des potentiels et de promotion du leadership des jeunes \xc2\xbb, a d\xc3\xa9clar\xc3\xa9 carole aghey, pr\xc3\xa9sidente de faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>lire aussi</strong> :<strong><a href=\"https://leadelles.tg/index.php/2026/06/20/leadership-feminin-au-sommet-de-la-finance-togolaise-estelle-fafa-akue-komlan-une-ascension-qui-redefinit-les-codes-bancaires/\">leadership f\xc3\xa9minin au sommet de la finance togolaise : estelle fafa akue komlan, une ascension qui red\xc3\xa9finit les codes bancaires</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l\xe2\x80\x99hommage, cette distinction appara\xc3\xaet comme un signal fort en faveur de la consolidation des initiatives citoyennes f\xc3\xa9minines dans les secteurs essentiels du d\xc3\xa9veloppement. elle souligne \xc3\xa9galement l\xe2\x80\x99importance des synergies entre organisations engag\xc3\xa9es pour amplifier l\xe2\x80\x99impact social.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans cette dynamique, la faea entend poursuivre son action avec d\xc3\xa9termination, convaincue que l\xe2\x80\x99engagement citoyen, le leadership et l\xe2\x80\x99action communautaire constituent des leviers essentiels de transformation durable des soci\xc3\xa9t\xc3\xa9s.</p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.68.89
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/946b6a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.23.33
country_id: 3625428
description:
[2026-06-20 11:24:26 +0000] info [cpaneld] 181.208.23.33 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.169.213.211
country_id: 732800
description:
Jun 20 11:25:23 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.169.213.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-20 11:25:42 +0000] info [cpaneld] 5.231.255.50 - glfmqhlj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-20 11:26:22 +0000] info [cpaneld] 5.230.133.20 - apicafe "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9789847&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954759 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:26:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247763&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954759 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-20 11:26:03 +0000] info [cpaneld] 134.195.83.234 - ljrwwgxg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-20 11:25:34 +0000] info [cpaneld] 5.230.153.230 - cetitiuu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-20 11:25:50 +0000] info [cpaneld] 107.174.169.209 - xflhqsmv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.169.213.211
country_id: 732800
description:
Jun 20 11:25:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.169.213.211 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:25:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:25:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.109
country_id: 6252001
description:
[2026-06-20 11:25:57 +0000] info [cpaneld] 134.195.83.109 - ubwmytwf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ubwmytwf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-20 11:26:57 +0000] info [cpaneld] 64.44.62.240 - nadngfzn "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-20 11:27:06 +0000] info [cpaneld] 5.230.153.13 - dmmkifel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-20 11:27:25 +0000] info [cpaneld] 134.195.83.78 - hsufgiqg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User hsufgiqg has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.185
country_id: 2635167
description:
[2026-06-20 11:27:13 +0000] info [cpaneld] 5.230.153.185 - himcuijv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-20 11:26:35 +0000] info [cpaneld] 5.230.153.26 - arsetg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-20 11:27:58 +0000] info [cpaneld] 173.211.89.140 - zgqykfsi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.125
country_id: 2635167
description:
[2026-06-20 11:28:04 +0000] info [cpaneld] 5.230.153.125 - vefzejhd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.215
country_id: 2635167
description:
[2026-06-20 11:28:08 +0000] info [cpaneld] 5.230.133.215 NEW cietg:bn_9eHz1XtS5JoV3 address=5.230.133.215,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.1.93
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-29.206.232.1.93||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-20 11:28:33 +0000] info [cpaneld] 5.230.133.240 NEW cafetg:dFHpBTkLSUVB1MA6 address=5.230.133.240,app=cpaneld,creator=cafetg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.228
country_id: 6252001
description:
[2026-06-20 11:28:48 +0000] info [cpaneld] 64.44.62.228 NEW cafeitadm:cOQfb5gLWzbkzvFx address=64.44.62.228,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-20 11:29:00 +0000] info [cpaneld] 107.175.5.177 - assedderetrm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-20 11:29:36 +0000] info [cpaneld] 5.230.133.16 - muzsajnk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-20 11:30:07 +0000] info [cpaneld] 5.231.64.90 - centif "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.122
country_id: 2635167
description:
[2026-06-20 11:30:13 +0000] info [cpaneld] 5.230.153.122 - afdim "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.212
country_id: 2635167
description:
[2026-06-20 11:30:17 +0000] info [cpaneld] 5.230.133.212 - cfpjusti "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-20 11:30:22 +0000] info [cpaneld] 5.231.64.56 - yxhnfwxr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.94
country_id: 2635167
description:
[2026-06-20 11:30:44 +0000] info [cpaneld] 5.230.153.94 - cloudetracks "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:31:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804487&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955061 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.195
country_id: 6252001
description:
[2026-06-20 11:31:09 +0000] info [cpaneld] 64.44.62.195 - fnnjmavs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-20 11:31:02 +0000] info [cpaneld] 107.175.5.35 - ygeaivhj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:31:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185574&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955065 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.254.224.164
country_id: 1880251
description:
[2026-06-20 11:31:13 +0000] info [whostmgrd] 54.254.224.164 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 149.102.239.226
country_id: 798549
domain: derou.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53383.derou.tg||ServerName:derou.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b38c33f970ec250b198c0a4afbe252af52aac36e||Title:0x46d95dc8||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:11:31:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923272&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955084 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-20 11:31:51 +0000] info [cpaneld] 64.44.62.229 - myxlsnta "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-20 11:32:14 +0000] info [cpaneld] 5.230.153.42 - mvfxewjz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-20 11:32:21 +0000] info [cpaneld] 173.211.89.140 - davetkoo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-20 11:31:36 +0000] info [cpaneld] 5.230.153.179 - wcdxbboq "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-20 11:31:56 +0000] info [cpaneld] 5.230.133.110 NEW rbnbkmre:qJxaZP6h59IqRaJ7 address=5.230.133.110,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-20 11:32:39 +0000] info [cpaneld] 64.44.62.24 - zmfpejke "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User zmfpejke has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.137.115
country_id: 690791
description:
Jun 20 11:32:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.137.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.237
country_id: 2395170
description:
Jun 20 11:33:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-20 11:33:09 +0000] info [cpaneld] 5.230.133.158 - kygyhxkc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-20 11:32:43 +0000] info [cpaneld] 5.230.153.211 - ylhgcaui "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-20 11:32:28 +0000] info [cpaneld] 64.44.59.151 - dgdntogo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.233.243.34
country_id: 3469034
description:
170.233.243.34 - - [20/Jun/2026:11:32:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379610&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdimas-dzikodo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955159 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dimas-dzikodo/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.4306.1491 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.233.243.34


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-20 11:33:00 +0000] info [cpaneld] 5.230.133.56 - uubplgpf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-20 11:33:44 +0000] info [cpaneld] 5.230.153.14 - afgqjhmw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-20 11:33:54 +0000] info [cpaneld] 5.230.153.33 - arsjawjaz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-20 11:34:16 +0000] info [cpaneld] 134.195.83.78 NEW tgkkwsvr:UT3fHfyN0xl_zd19 address=134.195.83.78,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-20 11:34:51 +0000] info [cpaneld] 107.175.5.35 - tubobkfl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-20 11:35:00 +0000] info [cpaneld] 5.231.255.50 - rdlizssu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-20 11:35:05 +0000] info [cpaneld] 5.230.133.148 - jvrzfkho "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-20 11:35:20 +0000] info [cpaneld] 5.230.153.167 - fgbegmfv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.114
country_id: 2635167
description:
[2026-06-20 11:36:13 +0000] info [cpaneld] 5.230.133.114 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.51.88.60
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/Association.jpeg 720w, http:/togodailynews.tg/wp-content/uploads/2021/08/Association-300x218.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.168
country_id: 3017382
description:
[2026-06-20 11:35:49 +0000] info [cpaneld] 5.231.64.168 NEW kpmg:ddiKNJZjxaNNxrb4 address=5.231.64.168,app=cpaneld,creator=kpmg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.215
country_id: 3469034
description:
Jun 20 11:36:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-06-20 11:36:36 +0000] info [cpaneld] 5.230.153.74 - lhxhatyj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-20 11:36:42 +0000] info [cpaneld] 5.230.153.254 NEW vuvwskxh:glaKYUybc_pp9itf address=5.230.153.254,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-20 11:37:16 +0000] info [cpaneld] 5.230.153.108 NEW utkxprkk:J116cIyGOf41EEqN address=5.230.153.108,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.215
country_id: 3469034
description:
Jun 20 11:36:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-20 11:38:25 +0000] info [cpaneld] 5.230.153.211 - dxsiclpd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-20 11:37:37 +0000] info [cpaneld] 107.174.169.229 NEW libertepansel:LBsjcNFoep1bs_Zz address=107.174.169.229,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.35.101.108
country_id: 1880251
description:
2026-06-20 11:37:59 dovecot_plain authenticator failed for H=(d2grkf50l0dstyx7gtzstpiamtcuneyj) [213.35.101.108]:34562: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-20 11:39:09 +0000] info [cpaneld] 5.230.133.177 - jmtctoni "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-20 11:39:55 +0000] info [cpaneld] 173.211.89.140 NEW tqbcalqt:MholSI9NBz2h5M4J address=173.211.89.140,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.23.33
country_id: 3625428
description:
[2026-06-20 11:40:42 +0000] info [cpaneld] 181.208.23.33 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.74.66.15
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/469996200 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.140.77.168
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/618376615 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-20 11:40:29 +0000] info [cpaneld] 5.230.133.117 - moodlefreenetmas "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-20 11:40:43 +0000] info [cpaneld] 64.44.62.223 NEW netfreenet:K2G61FsfJQ1qGMw1 address=64.44.62.223,app=cpaneld,creator=netfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-20 11:41:12 +0000] info [cpaneld] 5.230.153.33 - neliam "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-20 11:41:22 +0000] info [cpaneld] 5.230.153.230 NEW gsizyncj:DTFY3rALrw3HgBhc address=5.230.153.230,app=cpaneld,creator=gsizyncj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:41:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933461&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955711 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-20 11:42:16 +0000] info [cpaneld] 107.175.5.84 - pnls "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:41:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:41:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.138
country_id: 6252001
description:
[2026-06-20 11:41:47 +0000] info [cpaneld] 173.211.89.138 - pmalabvi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:41:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923442&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955712 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.200.22.140
country_id: 1562822
description:
2026-06-20 11:42:29 dovecot_plain authenticator failed for H=(i62ojp6q9zdz0ugbjoup) [103.200.22.140]:54746: 535 Incorrect authentication data (set_id=kpip@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-20 11:42:29 +0000] info [cpaneld] 5.230.153.38 - qjzcsoob "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.255
country_id: 3469034
description:
Jun 20 11:42:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.255 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-20 11:43:03 +0000] info [cpaneld] 5.230.153.136 - qfaclpeg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-20 11:43:19 +0000] info [cpaneld] 64.44.59.151 - bighostingsnbd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-20 11:44:27 +0000] info [cpaneld] 134.195.83.16 - waywcbyw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-20 11:43:32 +0000] info [cpaneld] 5.230.153.167 - sxoyfjqv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.78
country_id: 3017382
description:
[2026-06-20 11:43:58 +0000] info [cpaneld] 5.231.255.78 NEW aneos:xuZwotrp0kzmDfgf address=5.231.255.78,app=cpaneld,creator=aneos,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-20 11:44:37 +0000] info [cpaneld] 134.195.83.207 - elmkvzcm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-06-20 11:44:57 +0000] info [cpaneld] 5.230.153.23 - ulduzncs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-20 11:45:13 +0000] info [cpaneld] 5.230.133.20 - wttzshhf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User wttzshhf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-20 11:45:21 +0000] info [cpaneld] 107.175.5.140 - cipvzfnv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:46:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515657&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955958 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:46:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185876&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955958 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.143
country_id: 3017382
description:
[2026-06-20 11:46:03 +0000] info [cpaneld] 5.231.64.143 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-20 11:46:15 +0000] info [cpaneld] 5.231.255.233 - xdkbrmjc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.143
country_id: 3017382
description:
[2026-06-20 11:45:31 +0000] info [cpaneld] 5.231.255.143 - togoinrdceh "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-20 11:45:35 +0000] info [cpaneld] 5.230.133.154 NEW ecukpqcm:Ofe6eyaMAMEAmVBu address=5.230.133.154,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-20 11:46:48 +0000] info [cpaneld] 5.230.153.18 - aopsacai "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-20 11:46:44 +0000] info [cpaneld] 5.175.229.192 NEW cietg:PzLW1hDDe9sK3soT address=5.175.229.192,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-20 11:48:19 +0000] info [cpaneld] 5.230.153.227 NEW sodigaz:HMBul8S5UcRNqAhX address=5.230.153.227,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 11:49:19 +0000] info [cpaneld] 152.42.200.110 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.124.226
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.43.jpeg 737w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.43-300x191.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.136
country_id: 2635167
domain: letempsdaider.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/utkxprkk/public_html/.799879871641801.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-20 11:51:22 +0000] info [cpaneld] 5.230.153.13 NEW tqbcalqt:44g8hHt15wcJEp5p address=5.230.153.13,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-20 11:51:24 +0000] info [cpaneld] 5.230.153.229 NEW tgkkwsvr:T6autKocRle3HEsh address=5.230.153.229,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-20 11:50:43 +0000] info [cpaneld] 64.44.62.24 NEW utkxprkk:3gYk0gFSRqJFF0qh address=64.44.62.24,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.133
country_id: 2635167
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.761961273551815.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.52.202
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1167527528 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.33
country_id: 2635167
domain: letempsdaider.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/utkxprkk/public_html/.835415091749313.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.254.163.126
country_id: 458258
description:
Jun 20 11:52:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.254.163.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.201.116.176
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1119917110 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.77.250
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/1347724381 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.121.234.210
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/295483657 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-20 11:52:41 +0000] info [cpaneld] 5.231.64.56 NEW utkxprkk:ATLPNk8NUYBz8euR address=5.231.64.56,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.109
country_id: 6252001
description:
[2026-06-20 11:53:10 +0000] info [cpaneld] 134.195.83.109 NEW sodigaz:ECKExUIy18NpN61b address=134.195.83.109,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-20 11:53:16 +0000] info [cpaneld] 5.230.133.225 NEW utkxprkk:o9JmBJcF1kcDiWI9 address=5.230.133.225,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 11:53:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.235
country_id: 3865483
description:
Jun 20 11:53:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jun 20 11:54:26 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jun 20 11:54:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:56:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724249&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956563 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:56:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858917&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956563 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:55:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.149.199
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/469442016 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-20 11:58:40 +0000] info [cpaneld] 134.195.83.16 NEW naduwpdk:TvU9qi1CpKkE_zuc address=134.195.83.16,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.166.242.236
country_id: 6252001
description:
35.166.242.236 - - [20/Jun/2026:12:00:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13263508&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776%252F40636423c4130eeb315603afd55740c9%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956842 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776/40636423c4130eeb315603afd55740c9/index.php?cmd=newupld/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.166.242.236


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.65.60
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-usa-faure-gnassingbe-et-florizelle-liser-renforcent-le-partenariat-economique/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.65.60
country_id: 99237
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-usa-faure-gnassingbe-et-florizelle-liser-renforcent-le-partenariat-economique/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.42
country_id: 3469034
description:
Jun 20 12:00:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:12:01:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7456158&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956892 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:01:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302083&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956888 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.160.225.40
country_id: 272103
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/loading HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.225.59
country_id: 1733045
description:
180.74.225.59 - - [20/Jun/2026:12:03:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788708&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-vers-un-renforcement-des-chaines-de-valeurs-en-ressources-humaines%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957027 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-vers-un-renforcement-des-chaines-de-valeurs-en-ressources-humaines/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.225.59


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.231.121.75
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/7d6e79 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.144
country_id: 2921044
description:
[2026-06-20 12:10:50 +0000] info [cpaneld] 217.181.84.144 - scan@togosem.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.14
country_id: 3175395
description:
Jun 20 12:12:17 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:11:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:11:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.33
country_id: 3469034
description:
Jun 20 12:11:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.14
country_id: 3175395
description:
Jun 20 12:12:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:12:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128932&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957552 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:12:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787993&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957553 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


