# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.28.148
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[3][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[2][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.190.120
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[10][self::SECTION]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[3][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:09:17:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236805&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774219 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.26.22
country_id: 933860
description:
Jun 18 09:18:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.26.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:09:21:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003114&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774495 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.42
country_id: 3469034
description:
Jun 18 09:22:19 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.224.169
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[2][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[6][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.162.88.160
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[2][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[5][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.255.78.151
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[10][self::SECTION]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[7][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.42
country_id: 3469034
description:
Jun 18 09:22:25 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.177.213
country_id: 3469034
description:
Jun 18 09:23:50 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.177.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.68.76.241
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/757f7c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.99.160
country_id: 3865483
description:
Jun 18 09:28:22 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.99.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.99.160
country_id: 3865483
description:
Jun 18 09:28:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.99.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [18/Jun/2026:09:29:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750376&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774969 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [18/Jun/2026:09:29:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658244&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogolais-vivants-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774976 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togolais-vivants-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.131.96.227
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-B-1.jpeg 735w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-B-1-300x163.jpeg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/18/2026:09:31:56 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:09:32:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525803&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775122 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-18 09:31:27 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:bKtbTlz2EOaZiv7A address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.136
country_id: 3469034
description:
Jun 18 09:31:43 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:36:06 +0000] info [cpaneld] 160.187.56.0 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.254.246
country_id: 3017382
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:148.135.254.246||TA:148.135.254.246||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.105.198
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.239.105.198||TA:104.239.105.198||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:09:38:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7326367&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775510 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.149.103
country_id: 2363686
description:
[2026-06-18 09:40:57 +0000] info [webmaild] 196.168.149.103 - odoo2@dagl.tg "POST /cpsess2983208374/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.16.242] != Current IP Address [196.168.149.103]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:41:11 +0000] info [cpaneld] 160.187.56.0 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.141.2
country_id: 1880251
domain: tdn.tg
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/agribusiness-fondation-sea-sheyi-adebayor-formation-jeunes-conditions/fondationsea.com||User:elmkvzcm||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:42:37 +0000] info [cpaneld] 160.187.56.0 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 114.237.40.30
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/categories?search=public&per_page=5||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.251.39.192
country_id: 2264397
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5749eaf81b00cabee5fa95b0a86953c48969e420||Title:Coronavirus disease 2019||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 94.41.140.82
country_id: 2017370
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 223.150.63.196
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 139.47.23.58
country_id: 2510769
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.55.60
country_id: 1880251
domain: chuso.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 105.109.120.170
country_id: 2589581
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.73.206
country_id: 3865483
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.239.73.206||TA:104.239.73.206||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.0.19.242
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-1024x740.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-300x217.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-768x555.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-510x369.jpeg 510w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1.jpeg 1417w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:09:45:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646683&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775926 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [18/Jun/2026:09:46:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803887&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775964 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.136.224.173
country_id: 3996063
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/kick-off-meeting-2021 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.0.186.139
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-officiel-djama-lager HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.203.183
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:38.154.203.183||TA:38.154.203.183||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [18/Jun/2026:09:47:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118253&pdata=https%253A%252F%252Ftdn.tg%252Ftogoexplosion-port-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776023 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togoexplosion-port-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.191.65.97
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2023/10/Arr.-Resultats-Lyc\xc3\xa9e-Scientifique.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.197.86.8
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cfa382 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:09:52:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339945&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776375 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.91
country_id: 3469034
description:
Jun 18 09:54:07 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.175
country_id: 3469034
description:
Jun 18 09:54:29 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:54:51 +0000] info [cpaneld] 160.187.56.0 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:57:04 +0000] info [cpaneld] 160.187.56.0 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:57:31 +0000] info [cpaneld] 160.187.56.0 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-18 09:59:48 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:02:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13147083&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776930 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.96.52.79
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.152.39.28
country_id: 2635167
description:
185.152.39.28 - - [18/Jun/2026:10:02:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923275&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%25255C%253Dy3j1zguub3blcmf0aw9uc0byawwuy29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776959 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker%5C=y3j1zguub3blcmf0aw9uc0byawwuy29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.152.39.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.181.102.226
country_id: 1269750
domain: lasnb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93167.lasnb.com||ServerName:lasnb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ab377b05ddb06a9aae6e619396a0b42194b3314||Title:0x5552069f||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.19.151
country_id: 2363686
description:
[2026-06-18 10:04:19 +0000] info [webmaild] 196.171.19.151 - cat@ca-togo.org "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.181.102.226
country_id: 1269750
domain: lasnb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87516.lasnb.tg||ServerName:lasnb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:827a6309394d83a825b24789b6e610b65e41b1c9||Title:0x69b4add9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.46.191
country_id: 2635167
description:
85.203.46.191 - - [18/Jun/2026:10:04:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658974&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777093 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.46.191


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.234.229.4
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1143306905 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 158.41.147.81
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/categories?search=public&per_page=5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.19.151
country_id: 2363686
description:
[2026-06-18 10:05:47 +0000] info [webmaild] 196.171.19.151 - cat@ca-togo.org "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:06:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777158 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.19.151
country_id: 2363686
description:
[2026-06-18 10:05:29 +0000] info [webmaild] 196.171.19.151 - catsecretariat@ca-togo.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 46.158.158.35
country_id: 2017370
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 15_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 113.242.117.228
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.163 Mobile Safari/537.36 SamsungBrowser/26.0||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 68.224.161.54
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Infinix X6816D) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.86 Mobile Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.80
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/878386 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 10:09:00 +0000] info [cpaneld] 185.194.218.134 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.127.226.172
country_id: 2510769
description:
86.127.226.172 - - [18/Jun/2026:10:09:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936026&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY2Zlcm5hbmRlekBhbS1scy5lcw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777349 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y2Zlcm5hbmRlekBhbS1scy5lcw==" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.127.226.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 10:09:53 +0000] info [cpaneld] 185.194.218.134 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 10:11:43 +0000] info [cpaneld] 143.95.212.63 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.124
country_id: 1880251
description:
47.128.119.124 - - [18/Jun/2026:10:14:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184340&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777651 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 10:14:01 +0000] info [cpaneld] 185.194.218.134 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.251.172.237
country_id: 6252001
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/wp-content/uploads/2020/10/Ere-nouvelle-9-octobre-2020.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.64.253.74
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.letabloid.tg/wp-content/uploads/2020/10/Ere-nouvelle-9-octobre-2020.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.141.152.16
country_id: 2750405
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.109.159.37
country_id: 102358
domain: caissederetraites.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/caissederetraites.tg/sitemap.xml HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:18:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12805526&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777923 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.73.83.29
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1416576171 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.111.136.67
country_id: 1643084
description:
103.111.136.67 - - [18/Jun/2026:10:19:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933353&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprobleme-de-sante-publique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777985 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/probleme-de-sante-publique/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.7921.1977 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.111.136.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725847&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778046 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.140.167
country_id: 3469034
description:
Jun 18 10:21:41 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.140.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-18 10:22:53 +0000] info [cpaneld] 134.195.82.52 NEW qfaclpeg:nzmTJHfo4O_abFeT address=134.195.82.52,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.159.127
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:172.121.159.127||TA:172.121.159.127||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.122.252.45
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/817877 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.40.31.154
country_id: 3865483
description:
Jun 18 10:25:16 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.40.31.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 112.10.188.239
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 112.10.188.239
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Infinix X6816D) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.86 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.177.219.76
country_id: 290557
description:
109.177.219.76 - - [18/Jun/2026:10:31:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723688&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Ftogo-nouvelle-conference-du-cdl-consacree-au-moyen-orient%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778677 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/diplomatie/togo-nouvelle-conference-du-cdl-consacree-au-moyen-orient/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.177.219.76


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:33:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973543&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778808 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.142
country_id: 2300660
description:
Jun 18 10:35:52 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:36:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989019&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778982 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.136.228.101
country_id: 3469034
description:
2026-06-18 10:36:50 dovecot_login authenticator failed for H=(debian) [177.136.228.101]:48970: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:40:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:40:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.106.231.24
country_id: 6252001
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/wp-content/uploads/2021/12/Courrier-NU.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.132.137.175
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ada198 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-18 10:44:12 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55954: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:46:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197609&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779615 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.251
country_id: 3175395
description:
Jun 18 10:47:23 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.17
country_id: 1880251
description:
47.128.119.17 - - [18/Jun/2026:10:46:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194472&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12518&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779591 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12518" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.17


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.29.232.218
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:154.29.232.218||TA:154.29.232.218||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.251
country_id: 3175395
description:
Jun 18 10:47:29 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 18 10:49:33 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.142
country_id: 1880251
description:
47.128.119.142 - - [18/Jun/2026:10:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249928&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779831 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:50:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984907&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779822 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.160.196.220
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/61144615 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-18 10:53:39 +0000] info [cpaneld] 45.61.130.187 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:53:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.137.7
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-07-at-16.57.28.jpeg 1008w, http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-07-at-16.57.28-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-07-at-16.57.28-768x576.jpeg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:53:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [18/Jun/2026:10:59:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000538&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYy5hb3VkZS5jQHJjdS5nb3Yuc2E%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780377 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Yy5hb3VkZS5jQHJjdS5nb3Yuc2E=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b50582094ad294b696f87dc469296dc8867a1628||Title:rsgs6esdeyxx7e||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8dbb966be7c286a0902d3de98b53c5884bfbb852||Title:wjglf9asyvv4u77||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/18/2026:11:01:55 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce63eda1dc13bd3300a6e71b27f2513c4a5ac6a0||Title:cii75ylcrho22as||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [18/Jun/2026:11:02:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685402&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbXRmLmtoaTExQG1lZXphbmJhbmsuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780574 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bXRmLmtoaTExQG1lZXphbmJhbmsuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26cc46f899f90a3dae528c6128d3effbdfe4e756||Title:lxo5s92y11tg2dp4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.87.47
country_id: 2750405
description:
[2026-06-18 11:03:17 +0000] info [whostmgrd] 217.181.87.47 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:11:02:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212781&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780560 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.91.131
country_id: 3469034
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.253.91.131||TA:104.253.91.131||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [18/Jun/2026:11:02:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674139&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253Dy3j1zguub3blcmf0aw9uc0byawwuy29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780567 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=y3j1zguub3blcmf0aw9uc0byawwuy29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.214.210.205
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1853776714 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c9ea1c90630587457119216e0b95759678422bf||Title:32ymqkg6zevp862a||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.122
country_id: 3175395
description:
Jun 18 11:03:46 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.247.123.55
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-04.151.247.123.55||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9edb0311c758976b1cca4aca977c292f17b0f62d||Title:o5h8o0ihdkmr4tzh||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:05:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052972&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780751 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a9a11257d4938fa0e7569cb4533ac2a48eec93c7||Title:9oggddu1fh83l90lx4||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3171fbf82e8c3c53785edd0a736230c1d1884a12||Title:sv0bbnptm5jvjis2z8||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.123.55
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:151.247.123.55||TA:151.247.123.55||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.79
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:172.121.139.79||TA:172.121.139.79||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4e2dc5e72347b7ae534f277986c8f5ff3ba42fc||Title:7l8455plbzwcgr||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.12.117.176
country_id: 6251999
description:
[2026-06-18 11:09:20 +0000] info [cpaneld] 154.12.117.176 - libertepansel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.177.152
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:premier-seminaire-gouvernemental-lexecutif-en-conclave-pour-definir-ses-orientations/||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:60a4052fc0736ea8728aa0ba40a43838d9fa9129||Title:g9dzpjkk7rgzqa0b||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.244.230.63
country_id: 3489940
description:
104.244.230.63 - - [18/Jun/2026:11:09:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000788&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaHBsdW5rZXR0QG1lZ2FtYXJ0am0uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780990 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aHBsdW5rZXR0QG1lZ2FtYXJ0am0uY29t" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.244.230.63


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08533821f12c5d31f7768486e7365691854825fc||Title:8giombuz4sfmpuwxtx||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 11:09:34 +0000] info [cpaneld] 185.194.218.134 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:09:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:09:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:907314ae9966436a1d23c7bfa0ae4dc8a0a5203d||Title:a5e50o4cmakzaho||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b07caf05d50414159bb0e2c8765de9d4ea5cd96c||Title:78mvdbc8fal0f9m7||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:399f7cb96724e22648c1d16ac27300143dcf8b4c||Title:0nj00h003s95j0q||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.165
country_id: 2510769
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.143.245.165||TA:104.143.245.165||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee8620b513cdc261e8971521cf89d613b30831c7||Title:4intunyx1ll3pr8||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.59.222.108
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-300x300.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-1024x1024.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-150x150.webp 150w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-768x768.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28.webp 1254w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0385989fc10235b177911f2994ce55670d27f3ea||Title:v2gjt82rq76qz94d55||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2ba515d5a1207361b388c3aad2e3533fb8453ad||Title:g7hwo5wqbnm0wv8d||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-06-18 11:16:24 +0000] info [cpaneld] 5.230.153.74 NEW ttfuehop:TXn3oUp9YcSNdTgt address=5.230.153.74,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 13.217.90.244
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible XSS in arguments||MV:sig1=(\"@authority\" \"signature-agent\");created=1781781351;keyid=\"qdc6-vlwad4yd6yremqpjilim3bxffja_vhgl5qa71e\";alg=\"ed25519\";expires=1781781381;nonce=\"vvbev1wmewx4wj4fcbo rx2dfc8qtqg4fa5qrhq1vbyy/rq mojccowfxy/onpdb\";tag=\"web-bot-auth\"||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8dd4796b60fb87130090e7ecf061c251b57cc0f||Title:afw8j5v47f3n9nlyg4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-18 11:16:26 +0000] info [cpaneld] 5.230.133.133 NEW mbyqtkiw:uK4dvlb2YPhfepVe address=5.230.133.133,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.174.169.209
country_id: 6252001
domain: mftogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ttfuehop/public_html/.948419776064651.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.71.186.98
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/Haytham-608x270-1.png 608w, http:/togodailynews.tg/wp-content/uploads/2023/11/Haytham-608x270-1-300x133.png 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28a9bd26d91abbd62b209f4ef4b1b3ecbc59915c||Title:l7z79tp9hlkwr4t2nb||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 11:17:53 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53418: 535 Incorrect authentication data (set_id=student)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.175.154.108
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/Disponibilite-de-creales-ANSAT-repond-aux-besoins-des-populations.png 800w, http:/togodailynews.tg/wp-content/uploads/2021/07/Disponibilite-de-creales-ANSAT-repond-aux-besoins-des-populations-300x167.png 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/Disponibilite-de-creales-ANSAT-repond-aux-besoins-des-populations-768x427.png 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 11:18:45 +0000] info [cpaneld] 185.194.218.134 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.208.57
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.253.208.57||TA:104.253.208.57||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 196.171.23.59
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.18||T:APACHE||MVN:ARGS:dimClass||MV:unapproved||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:20:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315876&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781635 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>c\xe2\x80\x99est une nouvelle \xc3\xa9tape franchie dans les relations diplomatiques entre le togo et la tunisie. lundi 15 juin dernier, les deux pays ont sign\xc3\xa9 un m\xc3\xa9morandum d\xe2\x80\x99entente relatif \xc3\xa0 la mise en place de consultations politiques et diplomatiques r\xc3\xa9guli\xc3\xa8res.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9unis pour consolider l\xe2\x80\x99axe lom\xc3\xa9-tunis, les chefs de la diplomatie des deux pays ont, lundi 15 juin dernier, pos\xc3\xa9 les bases d\xe2\x80\x99un partenariat strat\xc3\xa9gique et durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en effet, les ministres des affaires \xc3\xa9trang\xc3\xa8res des deux pays, robert dussey et mohamed ali nafti, ont sign\xc3\xa9 un m\xc3\xa9morandum d\xe2\x80\x99entente crucial. il formalise la mise en place de consultations politiques et diplomatiques r\xc3\xa9guli\xc3\xa8res entre les deux pays. l\xe2\x80\x99objectif affich\xc3\xa9 est de favoriser un partenariat plus \xc3\xa9quilibr\xc3\xa9 et mutuellement avantageux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>dans cette perspective, un plan d\xe2\x80\x99actions conjoint couvrant la p\xc3\xa9riode 2026-2027, a \xc3\xa9t\xc3\xa9 convenu. ce document traduit les engagements pris en initiatives concr\xc3\xa8tes et de suivre leur mise en \xc5\x93uvre de mani\xc3\xa8re concert\xc3\xa9e. il s\xe2\x80\x99agit notamment de renforcer le dialogue direct entre lom\xc3\xa9 et tunis&nbsp;; donner un contenu op\xc3\xa9rationnel et pragmatique \xc3\xa0 la coop\xc3\xa9ration bilat\xc3\xa9rale, et de structurer durablement les \xc3\xa9changes pour passer des intentions aux actes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l'aspect purement diplomatique, l'\xc3\xa9conomie demeure le socle de ce rapprochement entre lom\xc3\xa9 et tunis. les deux parties partagent, en effet, une ambition forte, celle d\xe2\x80\x99intensifier leur int\xc3\xa9gration \xc3\xa9conomique en s'appuyant sur les m\xc3\xa9canismes continentaux, au premier rang desquels figure la zone de libre-\xc3\xa9change continentale africaine (zlecaf).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce cadre multilat\xc3\xa9ral offre de nouvelles opportunit\xc3\xa9s majeures pour les deux pays, notamment \xc3\xa0 travers la facilitation des \xc3\xa9changes commerciaux interafricains, la r\xc3\xa9duction progressive des barri\xc3\xa8res tarifaires et douani\xc3\xa8res, et le d\xc3\xa9veloppement de cha\xc3\xaenes de valeur r\xc3\xa9gionales comp\xc3\xa9titives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"660px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:660px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99en mettant en commun leurs forces, lom\xc3\xa9 et tunis d\xc3\xa9montrent que la coop\xc3\xa9ration sud-sud et l'int\xc3\xa9gration continentale sont des leviers incontournables pour la prosp\xc3\xa9rit\xc3\xa9 de l'afrique de demain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.201.74.3
country_id: 241170
domain: lepoint-actu.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-22.154.201.74.3||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [18/Jun/2026:11:23:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737832&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253DbWFqZWQuYWxzdWJpZUBhcmFtY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781791 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=bWFqZWQuYWxzdWJpZUBhcmFtY28uY29t" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.38
country_id: 6252001
description:
205.169.39.38 - - [18/Jun/2026:11:23:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804906&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253DbWFqZWQuYWxzdWJpZUBhcmFtY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781792 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=bWFqZWQuYWxzdWJpZUBhcmFtY28uY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.120.244
country_id: 1269750
description:
Jun 18 11:23:12 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.120.244 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [18/Jun/2026:11:23:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841499&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253DbWFqZWQuYWxzdWJpZUBhcmFtY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781792 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=bWFqZWQuYWxzdWJpZUBhcmFtY28uY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:24:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:24:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.182.12
country_id: 3469034
description:
Jun 18 11:26:03 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.176.182.12 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.135.166
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:107.175.135.166||TA:107.175.135.166||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [18/Jun/2026:11:31:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724248&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782294 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:11:32:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711962&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782352 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [18/Jun/2026:11:32:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645350&pdata=https%253A%252F%252Ftogodailynews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782360 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [18/Jun/2026:11:32:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120860&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782347 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.60.16.26
country_id: 3996063
description:
[2026-06-18 11:34:01 +0000] info [webmaild] 190.60.16.26 - emmanuel.megbenu@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.6.54
country_id: 1643084
description:
140.213.6.54 - - [18/Jun/2026:11:35:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13263763&pdata=https%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782519 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.6.54


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.110.8.143
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee.jpg 1600w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-1024x682.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-1536x1023.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:37:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300767&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782660 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.152.213
country_id: 1643084
description:
112.215.152.213 - - [18/Jun/2026:11:38:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869977&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782709 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.152.213


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:40:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.136.125
country_id: 2363686
description:
[2026-06-18 11:39:33 +0000] info [webmaild] 41.78.136.125 - dev@dgdn-togo.tg "POST /cpsess3195868098/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [41.78.136.107] != Current IP Address [41.78.136.125]


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:40:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.113.16.111
country_id: 174982
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/25-907-eleves-proteges-contre-la-faim-dans-la-region-de-la-kara/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.113.16.111
country_id: 174982
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/25-907-eleves-proteges-contre-la-faim-dans-la-region-de-la-kara/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.21.45
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c3bfb8 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.92.22.1
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-2.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-2-300x188.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-2-768x480.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.229.26.249
country_id: 6252001
description:
[2026-06-18 11:43:27 +0000] info [whostmgrd] 83.229.26.249 - root "GET /json-api/loadavg HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.141.220.54
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/qualite-des-prestations-de-la-ceet-larse-prete-une-oreille-attentive-a-latc/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.229.26.249
country_id: 6252001
description:
[2026-06-18 11:45:32 +0000] info [whostmgrd] 83.229.26.249 - root "POST /json-api/create_user_session?api.version=1&user=root HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.202.83
country_id: 2017370
description:
2026-06-18 11:46:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [46.45.202.83]:42098: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-06-18 11:46:40 dovecot_login authenticator failed for H=([221.235.182.76]) [102.211.7.162]:45290: 535 Incorrect authentication data (set_id=dbamaze@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:11:46:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922202&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781783205 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-18 11:48:15 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:40076: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:48:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781783335 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-18 11:54:40 +0000] info [whostmgrd] 80.248.64.198 - root "POST /cpsess4179796351/scripts2/dogencrt HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [104.28.154.50] != Current IP Address [80.248.64.198]


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-18 11:54:45 +0000] info [whostmgrd] 80.248.64.198 NEW root:ai8KcpD91pbfRLsG address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.239.176.49
country_id: 798549
domain: cfpj.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:193.239.176.49||TA:193.239.176.49||


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-18 11:54:40 +0000] info [whostmgrd] 80.248.64.198 PURGE root:Fib_EytJYaAQ9DCO badpass [cookie ip check: IP address has changed: IP Address [104.28.154.50] != Current IP Address [80.248.64.198]]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.221
country_id: 3469034
description:
Jun 18 11:55:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 11:55:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49592: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:56:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:56:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - faustinhoinso@flp-tg.com [06/18/2026:11:57:29 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: faustinhoinso@flp-tg.com


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - elisagou@flp-tg.com [06/18/2026:11:58:35 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: elisagou@flp-tg.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:02:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999258&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784117 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.223.120
country_id: 2363686
description:
[2026-06-18 12:02:12 +0000] info [cpaneld] 102.64.223.120 NEW mgvybwur:vvPOUAb_4qZvvvpU address=102.64.223.120,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:mgvybwur:WH3iUky4i8GaDkoM:create_user_session,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.144.47
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/716e56 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:04:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014421&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784260 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.28.241.204
country_id: 3865483
domain: www.derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.derou.tg/Concours HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-18 12:04:03 +0000] info [cpaneld] 5.175.229.192 NEW cietg:Qv9Lok0oYCkJovfd address=5.175.229.192,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-18 12:07:23 +0000] info [cpaneld] 103.59.161.65 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-18 12:07:43 +0000] info [webmaild] 160.242.199.70 - yadjor@caissederetraites.tg "POST /cpsess9434851994/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [160.242.199.70]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:08:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:08:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [18/Jun/2026:12:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13354909&pdata=https%253A%252F%252Fits.tg%252Fdata.js&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784542 HTTP/2.0" 302 0 its.tg "https://its.tg/data.js" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>la 11<sup>\xc3\xa8me</sup> conf\xc3\xa9rence des nations unies sur les oc\xc3\xa9ans s\xe2\x80\x99est tenue du 16 au jeudi 18 juin dernier, dans la capitale k\xc3\xa9nyane. plac\xc3\xa9e sous le th\xc3\xa8me\xc2\xa0: \xc2\xab\xc2\xa0notre oc\xc3\xa9an, notre patrimoine, notre avenir\xc2\xa0\xc2\xbb, cette rencontre internationale majeure a r\xc3\xa9uni les d\xc3\xa9cideurs mondiaux, dont une d\xc3\xa9l\xc3\xa9gation togolaise, autour de l'urgence climatique et de la sauvegarde des \xc3\xa9cosyst\xc3\xa8mes marins.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des d\xc3\xa9bats \xc3\xa0 nairobi, la d\xc3\xa9l\xc3\xa9gation togolaise a tenu \xc3\xa0 valoriser les r\xc3\xa9formes et les efforts entrepris \xc3\xa0 l'\xc3\xa9chelle nationale. le togo s'illustre particuli\xc3\xa8rement par l'int\xc3\xa9gration syst\xc3\xa9matique de la pr\xc3\xa9servation des \xc3\xa9cosyst\xc3\xa8mes marins dans ses politiques publiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'approche togolaise repose sur un \xc3\xa9quilibre crucial : allier la protection de la biodiversit\xc3\xa9 et le soutien aux populations c\xc3\xb4ti\xc3\xa8res, dont la survie \xc3\xa9conomique d\xc3\xa9pend directement des ressources de la mer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"676px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:676px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99un des grands chantiers actuels du pays reste la mise en place de zones strat\xc3\xa9giques de conservation. <em>\xc2\xab l\xe2\x80\x99un des buts de la participation du togo \xc3\xa0 cette rencontre est de mieux cerner les enjeux internationaux li\xc3\xa9s \xc3\xa0 la protection des oc\xc3\xa9ans, afin d\xe2\x80\x99int\xc3\xa9grer les pr\xc3\xa9occupations des communaut\xc3\xa9s riveraines dans la cr\xc3\xa9ation d\xe2\x80\x99aires marines prot\xc3\xa9g\xc3\xa9es au togo. \xc2\xbb, </em>a expliqu\xc3\xa9anthe komi, directeur g\xc3\xa9n\xc3\xa9ral de l\xe2\x80\x99office de d\xc3\xa9veloppement et d\xe2\x80\x99exploitation des for\xc3\xaats (odef) et membre de la d\xc3\xa9l\xc3\xa9gation togolaise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que ces derni\xc3\xa8res ann\xc3\xa9es, lom\xc3\xa9 a intensifi\xc3\xa9 ses actions pour encadrer les activit\xc3\xa9s c\xc3\xb4ti\xc3\xa8res et freiner la d\xc3\xa9gradation de son littoral. face aux nouveaux d\xc3\xa9fis, l\xe2\x80\x99ex\xc3\xa9cutif togolais multiplie les initiatives r\xc3\xa9glementaires et concr\xc3\xa8tes pour garantir une gestion durable de ses ressources halieutiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>une dynamique qui s\xe2\x80\x99inscrit dans la lign\xc3\xa9e des r\xc3\xa9centes d\xc3\xa9clarations du ministre en charge de l\xe2\x80\x99\xc3\x89conomie maritime, edem tengue, qui rappelait notre responsabilit\xc3\xa9 collective lors de la c\xc3\xa9l\xc3\xa9bration de la journ\xc3\xa9e mondiale de l\xe2\x80\x99oc\xc3\xa9an, le 8 juin dernier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31156,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/cf280d22-5566-4950-b6b8-986b4a8db8fc-724x1024.jpg\" alt=\"\" class=\"wp-image-31156\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab r\xc3\xa9imaginer l\xe2\x80\x99oc\xc3\xa9an, ce n\xe2\x80\x99est pas le contempler, c\xe2\x80\x99est le sauver. ce n\xe2\x80\x99est pas en parler, c\xe2\x80\x99est l\xe2\x80\x99habiter autrement. c\xe2\x80\x99est cesser de le consid\xc3\xa9rer comme un h\xc3\xa9ritage in\xc3\xa9puisable et commencer \xc3\xa0 le traiter comme ce qu\xe2\x80\x99il est : un bien commun de l\xe2\x80\x99humanit\xc3\xa9, fragile, dont nous sommes les d\xc3\xa9positaires devant les g\xc3\xa9n\xc3\xa9rations \xc3\xa0 venir. \xc2\xbb,</em> avait-il soutenu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99en portant cette voix \xc3\xa0 nairobi, le togo r\xc3\xa9affirme qu'il ne se contente plus de subir les effets du d\xc3\xa9r\xc3\xa8glement climatique, mais s'impose comme un acteur proactif pour l\xc3\xa9guer un patrimoine maritime viable aux g\xc3\xa9n\xc3\xa9rations futures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-18 12:12:20 +0000] info [cpaneld] 103.59.161.65 - Benito "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Benito (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 18 12:13:41 ns5 pure-ftpd[2879380]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [18/Jun/2026:12:15:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117510&pdata=https%253A%252F%252Fits.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784914 HTTP/2.0" 302 0 its.tg "https://its.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:16:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987437&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784966 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69252.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb466a9f700eee5d5999db693649df5df3551e18||Title:0x35140956||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-18 12:18:59 +0000] info [cpaneld] 64.44.62.24 NEW dvhzmira:E4vAtwNSTKwcvj2S address=64.44.62.24,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.84.190.213
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/780498331 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc2b6987558f8d7a1001cd3dc1c9669db328417d||Title:0x5f2ec6f8||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.248.195
country_id: 1733045
description:
27.125.248.195 - - [18/Jun/2026:12:18:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9871048&pdata=https%253A%252F%252F24heureinfo.tg%252F%253Fp%253D10085&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785103 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/?p=10085" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.248.195


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5037b3e4fb880fecf3d5c9e3649cdcd27c9b287c||Title:0x0903855d||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.230
country_id: 690791
description:
Jun 18 12:20:30 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:20:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461802&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785239 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52952ef55cf8802ffec133fe1e79d919d60874ef||Title:0x2fb884ef||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:403f64538b72c13919eabcc8c6b4b3863eb60795||Title:0x1cd6123c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:23:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:23:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:23:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:23:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.109
country_id: 6252001
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.808654861395151.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:813d3b7e01e17c8ce45f81ad0fa1937eb9dcff65||Title:0x5b4d0d4c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-18 12:23:49 +0000] info [cpaneld] 5.231.255.50 NEW sahamtg:OcT9OA3tVpCLVmUp address=5.231.255.50,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d30c0b2b2f9f535e630c549f15ef895a400cae88||Title:0xa4c28b6d||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d5b9a4cb963c2b279bcd3f53460a5571389b909c||Title:0xf81558eb||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8740185f78ed1973fe12f3276f037fe9af9f938||Title:0xec89c148||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.138.89.226
country_id: 2395170
description:
41.138.89.226 - - [18/Jun/2026:12:28:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078099&pdata=https%253A%252F%252Fwww.snb.tg%252Fcareer&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785682 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/career" "Mozilla/5.0 (Linux; Android 15; Infinix X6725 Build/AP3A.240905.015.A2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.217 Mobile Safari/537.36" WL:"0" "com.google.android.apps.searchlite" XFF:"-" CAPTCHA:"0" PEER:41.138.89.226


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:af658214d044379b58c0c7b255044656cb25d792||Title:0x168528f3||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7bfd3392b19feeef8c7f4a3d3e11d22b4e58bf7a||Title:0x24ab8998||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:29:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594006&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785744 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:29:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129237&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785751 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cee18ec9bfe46863afcc60c3cb422d574f067c77||Title:0x2d86651f||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4250c0298f4c9a2438e12b9f55be850d09bc1c5f||Title:0xdf4c4a01||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:34:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053269&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786052 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-18 12:34:33 +0000] info [cpaneld] 5.230.133.179 NEW qfaclpeg:e2OygKjWa36Oms93 address=5.230.133.179,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.202.21.88
country_id: 6252001
description:
54.202.21.88 - - [18/Jun/2026:12:34:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592919&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786075 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.202.21.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 12:35:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:63995: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-18 12:35:41 +0000] info [cpaneld] 64.44.62.223 NEW frtwilql:KF52605iqUOGI46U address=64.44.62.223,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [18/Jun/2026:12:36:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgerry-taama%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786210 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gerry-taama/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:38:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:38:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:38:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:38:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.207.7
country_id: 3469034
description:
2026-06-18 12:39:17 dovecot_login authenticator failed for H=(192.145.207.7) [192.145.207.7]:46820: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.245.240.81
country_id: 2921044
description:
Jun 18 12:40:01 ns5 pure-ftpd[2899951]: (?@165.245.240.81) [INFO] New connection from 165.245.240.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-18 12:40:31 +0000] info [whostmgrd] 185.194.218.134 -  netmast  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 196.171.23.59
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36||MV:/wp-json/wp-site-health/v1/tests/authorization-header?_locale=user||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.229
country_id: 690791
description:
Jun 18 12:42:45 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.229 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:45:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446744&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786706 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le prestigieux sommet fii priority europe s\xe2\x80\x99est ouvert \xc3\xa0 rome, en italie, en pr\xc3\xa9sence du pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9. ce rendez-vous strat\xc3\xa9gique, qui s'impose comme le point de ralliement des leaders mondiaux, des investisseurs de premier plan et des d\xc3\xa9cideurs \xc3\xa9conomiques internationaux, se veut une plateforme unique pour repenser les mod\xc3\xa8les de croissance et anticiper les grandes transitions dans un contexte macro\xc3\xa9conomique en pleine mutation.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le rendez-vous de cette ann\xc3\xa9e porte sur des th\xc3\xa9matiques cruciales pour la stabilit\xc3\xa9 et la croissance globale. face aux crises g\xc3\xa9opolitiques et \xc3\xa9nerg\xc3\xa9tiques r\xc3\xa9centes, la souverainet\xc3\xa9 \xc3\xa9conomique est devenue la priorit\xc3\xa9 absolue des nations et des blocs r\xc3\xa9gionaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"608px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:608px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce sommet va s\xe2\x80\x99articuler autour de trois axes fondamentaux, \xc3\xa0 savoir&nbsp;: la comp\xc3\xa9titivit\xc3\xa9 globale, notamment comment stimuler l'innovation et l'attractivit\xc3\xa9 des march\xc3\xa9s dans un environnement hyper-comp\xc3\xa9titif ? ; la souverainet\xc3\xa9 \xc3\xa9conomique, qui passe par la r\xc3\xa9duction des d\xc3\xa9pendances strat\xc3\xa9giques tout en maintenant des partenariats internationaux solides&nbsp;; et la transformation technologique par l\xe2\x80\x99int\xc3\xa9gration de l'intelligence artificielle et les technologies propres pour garantir une croissance durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les participants devront profiter de ce rendez-vous pour concevoir de nouvelles strat\xc3\xa9gies de relocalisation, de r\xc3\xa9gionalisation et de diversification des sources d'approvisionnement, ceci dans l\xe2\x80\x99optique de <em>\xc2\xab passer d'une logique de flux tendus \xc3\xa0 une logique de r\xc3\xa9silience \xc3\xa9conomique \xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>a rome, le leader togolais va intervenir sur <em>\xc2\xab&nbsp;les perspectives du partenariat \xc3\xa9conomique entre l\xe2\x80\x99afrique et l\xe2\x80\x99europe, dans un contexte o\xc3\xb9 notre continent en se hissant progressivement parmi les \xc3\xa9conomies \xc3\xa0 croissance les plus rapides au monde, offre un espace strat\xc3\xa9gique pour les investissements, la connectivit\xc3\xa9, la logistique et l\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale&nbsp;\xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que le togo entend pleinement contribuer \xc3\xa0 cette dynamique en valorisant son r\xc3\xb4le de hub logistique et de porte d\xe2\x80\x99entr\xc3\xa9e naturelle vers l\xe2\x80\x99hinterland ouest-africain, au service d\xe2\x80\x99une croissance partag\xc3\xa9e, de corridors plus performants et d\xe2\x80\x99opportunit\xc3\xa9s accrues pour nos populations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>nous y reviendrons&nbsp;!!!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:45:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932629&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786711 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.95.200.219
country_id: 798544
description:
Jun 18 12:45:19 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.95.200.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 12:46:14 +0000] info [whostmgrd] 185.194.218.134 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.95.200.219
country_id: 798544
description:
Jun 18 12:45:27 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.95.200.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.153
country_id: 6252001
description:
[2026-06-18 12:46:12 +0000] info [cpaneld] 173.211.88.153 NEW doufelg:xHKyPqe8ZhJtc5FR address=173.211.88.153,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.178.196.15
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.178.196.15) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.49.109
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-1536x1024.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-2048x1365.jpeg 2048w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-272x182.jpeg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.66.113
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/776627109 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.14
country_id: 3469034
description:
Jun 18 12:49:00 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:51:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973381&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787060 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.11.43.186
country_id: 2562770
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/626a67 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.245.139
country_id: 3865483
description:
Jun 18 12:52:11 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.245.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.230.247.184
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/contact/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:53:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:53:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:54:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 12:59:12 +0000] info [cpaneld] 185.194.218.134 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:59:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211795&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787585 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:59:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998679&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787586 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Jun 18 13:02:17 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2026-06-18 13:02:19 dovecot_login authenticator failed for H=(116-59-11-115.emome-ip.hinet.net) [124.160.45.26]:60258: 535 Incorrect authentication data (set_id=dbamaze@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.78.188
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/6d7779 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.73.150.5
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-covid-19-reception-de-200-000-doses-du-vaccin-chinois-coronavac-ce-vendredi/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.134.167
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/439881706 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [18/Jun/2026:13:06:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659503&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787978 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.119.134
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:107.175.119.134||TA:107.175.119.134||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:13:06:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658199&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788003 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:08:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:08:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:08:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:08:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 13:08:59 +0000] info [cpaneld] 185.194.218.134 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.212.90
country_id: 933860
description:
Jun 18 13:11:05 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.212.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.150
country_id: 933860
description:
Jun 18 13:11:44 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le prestigieux sommet fii priority europe s\xe2\x80\x99est ouvert, le mercredi 17 juin 2026, \xc3\xa0 rome, en italie, en pr\xc3\xa9sence du pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9. ce rendez-vous strat\xc3\xa9gique, qui s'impose comme le point de ralliement des leaders mondiaux, des investisseurs de premier plan et des d\xc3\xa9cideurs \xc3\xa9conomiques internationaux, se veut une plateforme unique pour repenser les mod\xc3\xa8les de croissance et anticiper les grandes transitions dans un contexte macro\xc3\xa9conomique en pleine mutation.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le rendez-vous de cette ann\xc3\xa9e porte sur des th\xc3\xa9matiques cruciales pour la stabilit\xc3\xa9 et la croissance globale. face aux crises g\xc3\xa9opolitiques et \xc3\xa9nerg\xc3\xa9tiques r\xc3\xa9centes, la souverainet\xc3\xa9 \xc3\xa9conomique est devenue la priorit\xc3\xa9 absolue des nations et des blocs r\xc3\xa9gionaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"608px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:608px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce sommet va s\xe2\x80\x99articuler autour de trois axes fondamentaux, \xc3\xa0 savoir&nbsp;: la comp\xc3\xa9titivit\xc3\xa9 globale, notamment comment stimuler l'innovation et l'attractivit\xc3\xa9 des march\xc3\xa9s dans un environnement hyper-comp\xc3\xa9titif ? ; la souverainet\xc3\xa9 \xc3\xa9conomique, qui passe par la r\xc3\xa9duction des d\xc3\xa9pendances strat\xc3\xa9giques tout en maintenant des partenariats internationaux solides&nbsp;; et la transformation technologique par l\xe2\x80\x99int\xc3\xa9gration de l'intelligence artificielle et les technologies propres pour garantir une croissance durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les participants devront profiter de ce rendez-vous pour concevoir de nouvelles strat\xc3\xa9gies de relocalisation, de r\xc3\xa9gionalisation et de diversification des sources d'approvisionnement, ceci dans l\xe2\x80\x99optique de <em>\xc2\xab passer d'une logique de flux tendus \xc3\xa0 une logique de r\xc3\xa9silience \xc3\xa9conomique \xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>a rome, le leader togolais va intervenir sur <em>\xc2\xab&nbsp;les perspectives du partenariat \xc3\xa9conomique entre l\xe2\x80\x99afrique et l\xe2\x80\x99europe, dans un contexte o\xc3\xb9 notre continent en se hissant progressivement parmi les \xc3\xa9conomies \xc3\xa0 croissance les plus rapides au monde, offre un espace strat\xc3\xa9gique pour les investissements, la connectivit\xc3\xa9, la logistique et l\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale&nbsp;\xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que le togo entend pleinement contribuer \xc3\xa0 cette dynamique en valorisant son r\xc3\xb4le de hub logistique et de porte d\xe2\x80\x99entr\xc3\xa9e naturelle vers l\xe2\x80\x99hinterland ouest-africain, au service d\xe2\x80\x99une croissance partag\xc3\xa9e, de corridors plus performants et d\xe2\x80\x99opportunit\xc3\xa9s accrues pour nos populations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>nous y reviendrons&nbsp;!!!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.waverain.de
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.waverain.de/settings.json HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:13:13:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367063&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788405 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:13:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132889&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788405 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.75.86
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/05/Cabo_Verde_2023.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2023/05/Cabo_Verde_2023-300x188.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/05/Cabo_Verde_2023-768x480.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.26
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:LES AGENCES DU SYSTEME DES NATIONS UNIES DU BENIN ET DU TOGO EN CONCLAVE A LOME||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.83.155
country_id: 6252001
description:
[2026-06-18 13:16:03 +0000] info [cpaneld] 134.199.83.155 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 143.244.52.49
country_id: 798549
description:
143.244.52.49 - - [18/Jun/2026:13:17:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261351&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbXRmLmtoaTExQG1lZXphbmJhbmsuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788669 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bXRmLmtoaTExQG1lZXphbmJhbmsuY29t" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:143.244.52.49


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1fdc9dce391baa99c2dd8e370212d35b8d7aac6e||Title:fiozdu769mqdo24a||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2873e404dadbac6908d85b11dd2b43c5e196299d||Title:tqve82w2x5tgn5||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4226d6ab54812b6dd4c2cd6157c0435945a291b||Title:29vylll03vej7e88h||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.217
country_id: 3865483
description:
Jun 18 13:20:46 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.217 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3bd2357792a56c87159d3b0c0da98116b4b627df||Title:zl5m4f48y5i8l6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 18 13:23:16 ns5 pure-ftpd[2929608]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b831f366c262a4fa1516bbc3b9e6e09e9dbee36b||Title:laensptgrb2tow||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:59aa833b228ec578a4d8a6e726faa8b9c61f90fa||Title:kih6dia8wrq9khw2||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:13:24:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9620119&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789044 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0dda218532cd8ee3c823b05d534fec75f66955ba||Title:j4dhg4nwto1fdco||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:26:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:26:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:26:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:26:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6d7d0edde269d04675398d3745e7cef117e30e3||Title:flbz2fby7l96w6l||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d0011af606a55d33a27238c4a2e03ec6964c48ce||Title:nvohof66sy3j5atq||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.185.76.213
country_id: 2264397
description:
[2026-06-18 13:27:12 +0000] info [whostmgrd] 89.185.76.213 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:450d2a4bf68705991d0836bc76cf90ea742e1a3b||Title:iif7ejqjkaf18kn||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe7a31c7df7c80b5fe9ec3916f635f9390a7c635||Title:gskr32mm75t0n6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:13:29:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987221&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789363 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:29:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7392149&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789363 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03ad5dc3bbdf054ce532925f6bc633ce7d9adcae||Title:poyae1wcy9e4v1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-18 13:30:02 +0000] info [cpaneld] 103.253.27.219 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3b9be89295b3f2cbaa47242abde66b5845fde57||Title:swfyd7jo9cd4kxt||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.114
country_id: 2510769
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.143.245.114||TA:104.143.245.114||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: impactfireservices.co
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/impactfireservices.co/.env.example HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 149.102.227.104
country_id: 6252001
domain: dany2.mairie.tg
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-18 13:34:01 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.7.207
country_id: 2363686
description:
2026-06-18 13:35:05 dovecot_login authenticator failed for H=(SHESAME) [196.171.7.207]:53052: 535 Incorrect authentication data (set_id=s.mensah@cndh-togo.org)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.readmore.id
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.readmore.id/.config.json HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-18 13:36:21 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42142: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.179.188.22
country_id: 1643084
description:
[2026-06-18 13:36:30 +0000] info [cpaneld] 202.179.188.22 - elmkvzcm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:13:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249099&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789856 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 202.179.188.22
country_id: 1643084
domain: tdn.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.18||T:APACHE||SC:/home/elmkvzcm/public_html/wp-content/td_cache/td_analyze/css/normal.php||User:elmkvzcm||WPU:||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 13:39:20 +0000] info [cpaneld] 143.95.212.63 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: agricolservices.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agricolservices.com/.env.example HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.179.188.22
country_id: 1643084
description:
[2026-06-18 13:40:44 +0000] info [cpaneld] 202.179.188.22 - elmkvzcm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:40:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:40:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:40:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:40:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.227.127.2
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.110.223
country_id: 298795
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:166.88.110.223||TA:166.88.110.223||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.17.216
country_id: 3175395
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.239.17.216||TA:104.239.17.216||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: woo3web.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/woo3web.com/php.php HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:42:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409683&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781790161 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 202.179.188.22
country_id: 1643084
domain: tdn.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:msg||MV:Uncaught SyntaxError: Unexpected token '<'||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-18 13:42:54 +0000] info [cpaneld] 103.253.27.219 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.107.227.141
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/aa9c7d HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.93.165
country_id: 6252001
description:
2026-06-18 13:45:06 dovecot_login authenticator failed for H=(IEJBYlx7O) [38.248.93.165]:36102: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.93.165
country_id: 6252001
description:
2026-06-18 13:45:28 dovecot_login authenticator failed for H=(NbU7xtvke) [38.248.93.165]:36407: 535 Incorrect authentication data (set_id=supporthosting)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 74.0.103.247
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-46.74.0.103.247||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [18/Jun/2026:13:47:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999254&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781790472 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.145.229.230
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8c7e7b HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [18/Jun/2026:13:48:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985877&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781790501 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.104.11
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/efedf0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.238.217
country_id: 2921044
description:
Jun 18 13:50:32 ns5 pure-ftpd[2949143]: (?@164.90.238.217) [INFO] New connection from 164.90.238.217


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:55:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:55:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:55:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:55:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.140.23.61
country_id: 3703430
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9b8f86 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:58:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999301&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791127 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.112.199.54
country_id: 2328926
description:
[2026-06-18 13:58:59 +0000] info [cpaneld] 105.112.199.54 - yydrdvav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:13:58:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739411&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791128 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-18 13:58:53 dovecot_login authenticator failed for H=([146.56.225.248]) [27.71.21.70]:6990: 535 Incorrect authentication data (set_id=simtaya@cfpj.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-06-18 13:59:29 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com ([210.22.149.155]) [42.200.60.186]:54720: 535 Incorrect authentication data (set_id=evendeur@soena.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.113.56
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-00.89.124.113.56||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.132.150.147
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2066411116 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.61.4
country_id: 2623032
description:
2026-06-18 14:02:28 dovecot_plain authenticator failed for H=tor-project-exit4.dotsrc.org (izoz2svehe3q8qlm) [185.129.61.4]:65258: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [18/Jun/2026:14:02:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723227&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnovelas-tv%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791355 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/novelas-tv/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 14:04:24 +0000] info [cpaneld] 185.194.218.134 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 49.144.67.29
country_id: 1694008
description:
49.144.67.29 - - [18/Jun/2026:14:04:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054598&pdata=https%253A%252F%252Fwebmail.florian.free.netmaster.tg%252F%253Flocale%253Dpl&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791447 HTTP/2.0" 302 0 webmail.florian.free.netmaster.tg "https://webmail.florian.free.netmaster.tg/?locale=pl" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:49.144.67.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.143
country_id: 2750405
description:
192.42.116.143 - doufelg [18/Jun/2026:14:05:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277844&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791553 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.156.230.125
country_id: 3686110
description:
38.156.230.125 - - [18/Jun/2026:14:06:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662311&pdata=https%253A%252F%252Ftdn.tg%252Fuemoa-candidatures-bourses-financement-etudes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791564 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/uemoa-candidatures-bourses-financement-etudes/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.4290.1805 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.156.230.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-06-18 14:06:24 dovecot_login authenticator failed for H=([112.165.212.135]) [1.241.64.237]:53946: 535 Incorrect authentication data (set_id=dbabima@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.14
country_id: 2750405
description:
192.42.116.14 - doufelg [18/Jun/2026:14:05:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973334&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791544 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.137.55
country_id: 3469034
description:
2026-06-18 14:06:30 dovecot_login authenticator failed for H=(190.89.137.55) [190.89.137.55]:33453: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.88
country_id: 2363686
description:
[2026-06-18 14:06:31 +0000] info [webmaild] 160.242.192.88 - perception@butodra.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.113
country_id: 690791
description:
Jun 18 14:07:18 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.127.29
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/1555245825 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jun 18 14:08:19 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-06-18 14:08:21 dovecot_login authenticator failed for H=([178.178.194.151]) [119.92.76.210]:32922: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.113
country_id: 690791
description:
Jun 18 14:07:25 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.37
country_id: 2661886
description:
171.25.193.37 - qfaclpeg [18/Jun/2026:14:07:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13328742&pdata=https%253A%252F%252Fsia-togo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791651 HTTP/2.0" 302 0 sia-togo.tg "https://sia-togo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.37


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.156
country_id: 1814991
description:
Jun 18 14:08:39 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.18||T:APACHE||SC:/home/tubnyxbt/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.156
country_id: 1814991
description:
2026-06-18 14:08:41 dovecot_login authenticator failed for H=(bl10-203-209.dsl.telepac.pt) [27.24.141.156]:42216: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/tubnyxbt/public_html/wp-admin||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-18 14:09:27 +0000] info [cpaneld] 185.194.218.134 -  einguval  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/tubnyxbt/public_html/wp-includes||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:/home/tubnyxbt/public_html/wp-includes||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.31
country_id: 798544
description:
Jun 18 14:10:27 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.241.25.235
country_id: 798544
description:
Jun 18 14:10:55 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.241.25.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:12:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:12:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:12:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:12:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.153
country_id: 3865483
description:
Jun 18 14:13:25 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.180.197
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/31892612 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:15:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790313&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781792122 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:14:15:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002858&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781792123 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 14:16:56 +0000] info [cpaneld] 143.95.212.63 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94416.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:787aabd1f1e78f47f4789f92f1ad1528dfff5d95||Title:0x85d487c9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.99
country_id: 3865483
description:
Jun 18 14:17:28 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.105.232.125
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/718b40 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 18 14:17:47 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:94e3d68e6518a7632fd0beec67654cd9c1147feb||Title:0x398ffb13||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd25ebf0f64e79183388239e76aa2ca93887f936||Title:0x9e401c76||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:46927e93519508cc5e1d390e9b8b4c018564f211||Title:0x0717a3af||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8cfdd4b75521b9a458bb7ab83c2f8a7609a16b8d||Title:0xa9ebdbab||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5fdcfce26926b6b36bd68eacf8430c1130fa081||Title:0xfdf2fc60||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6003821ed7c716755440f01623c14e328c8755a6||Title:0xfae75762||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.76
country_id: 298795
description:
Jun 18 14:25:20 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.76
country_id: 298795
description:
Jun 18 14:25:26 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-06-18 14:25:32 dovecot_login authenticator failed for H=([91.86.88.24]) [111.26.106.115]:56064: 535 Incorrect authentication data (set_id=dbamaze@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 14:25:45 +0000] info [cpaneld] 143.95.212.63 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8bbf375c412595dfaa9d3b1d69cfe49514ba4fed||Title:0x583885fb||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9fbc58dd2f5cb2832a4508d713f7251958cc3dcd||Title:0xbd5a39dc||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.223.88.171
country_id: 2960313
description:
[2026-06-18 14:27:16 +0000] info [webmaild] 92.223.88.171 - test@arcop.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user nobody (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:684c89645838e5f4d8d6ddd75e0f169f4fc0288a||Title:0xe7090d40||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:28:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:28:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:28:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb5305ba7d579a697fe9d2a04f00c6e57d96310f||Title:0xbfa722dc||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:28:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ac1de9c3cbf9acb7a214551a74fb6077d1b5ce4f||Title:0x38e175ac||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4843786eb7ac95aa638c34a90c60db4bc9da8820||Title:0x8b0535f5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.122.170.10
country_id: 2750405
description:
[2026-06-18 14:32:08 +0000] info [webmaild] 185.122.170.10 - dossa.amoussou@arse.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e4468fc9633ece05e08373e93d7b419c23caf86e||Title:0x879bd0c0||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [18/Jun/2026:14:32:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6910100&pdata=http%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793167 HTTP/1.1" 302 0 www.centif.tg "http://www.centif.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df35b4f5b89fceabfe466be55ac0dd61a5bee385||Title:0xfd38eef6||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.74
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-34.148.222.185.74||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e87423ac092bfff2c5a2494f9b5ed07312d498a||Title:0xd099c252||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:14:34:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738344&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793290 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [18/Jun/2026:14:34:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064229&pdata=https%253A%252F%252Fwww.centif.tg%252Fstorage%252Fupload%252F1737634221-200px-ECOWAS%25255flogo.svg.webp&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793297 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/storage/upload/1737634221-200px-ECOWAS%5flogo.svg.webp" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcf37d25df1c70b8a253ecb9a49000ce8ac899d8||Title:0x1ad7b7af||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:34:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185157&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793288 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:36:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59422: 535 Incorrect authentication data (set_id=filetype)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:36:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45390: 535 Incorrect authentication data (set_id=images4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:36:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62102: 535 Incorrect authentication data (set_id=antispam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:36:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4940: 535 Incorrect authentication data (set_id=excellence)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a226c4c686871f69f7fe36cbf633231437fd3e1||Title:0xbce87e72||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:36:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48430: 535 Incorrect authentication data (set_id=atlasit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:36:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14392: 535 Incorrect authentication data (set_id=104)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:36:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8428: 535 Incorrect authentication data (set_id=images4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:36:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55352: 535 Incorrect authentication data (set_id=filetype)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:36:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19746: 535 Incorrect authentication data (set_id=antispam)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5961b874044484d8772baa2c1ee474004e645210||Title:0x2b780a71||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:36:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32282: 535 Incorrect authentication data (set_id=lamp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:36:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61524: 535 Incorrect authentication data (set_id=excellence)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:37:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2850: 535 Incorrect authentication data (set_id=ecole)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:37:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14408: 535 Incorrect authentication data (set_id=cptest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:37:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33910: 535 Incorrect authentication data (set_id=amateur)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:37:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58486: 535 Incorrect authentication data (set_id=anand)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b750cbb5217be06f2a4ebfe8445ed04049b7410f||Title:0xd0e5130f||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:37:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25242: 535 Incorrect authentication data (set_id=telefonia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:37:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60478: 535 Incorrect authentication data (set_id=admin01)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.104.249
country_id: 1269750
description:
[2026-06-18 14:38:10 +0000] info [webmaild] 172.94.104.249 - contact@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:38:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62948: 535 Incorrect authentication data (set_id=carlos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:38:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52558: 535 Incorrect authentication data (set_id=spamfilter2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:38:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1396: 535 Incorrect authentication data (set_id=supplierid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:38:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43508: 535 Incorrect authentication data (set_id=cindy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:38:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50448: 535 Incorrect authentication data (set_id=vedono)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.177.53.225
country_id: 1282988
domain: www.derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.derou.tg/contact HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:38:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34930: 535 Incorrect authentication data (set_id=realty)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f193dc34fb085dfa167e76168ee394f8db76c898||Title:0xb8e05666||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:39:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2496: 535 Incorrect authentication data (set_id=bennett)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:39:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47932: 535 Incorrect authentication data (set_id=photos6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:39:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14454: 535 Incorrect authentication data (set_id=2232)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa92e0df8d5f4799d45dbd79876d05b39e114a76||Title:0xacb51b66||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:39:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30624: 535 Incorrect authentication data (set_id=vw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:39:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:31258: 535 Incorrect authentication data (set_id=ferrara)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:39:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28816: 535 Incorrect authentication data (set_id=}stadkomma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:39:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52804: 535 Incorrect authentication data (set_id=vw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:40:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3700: 535 Incorrect authentication data (set_id=hw)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.241.25.235
country_id: 798544
description:
Jun 18 14:40:42 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.241.25.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:40:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43248: 535 Incorrect authentication data (set_id=offer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:40:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28814: 535 Incorrect authentication data (set_id=apisecret)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:40:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:65526: 535 Incorrect authentication data (set_id=vdi)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f456dbd2ca817f12231536a15b2019d5f2e73728||Title:0x88a67828||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.46.136
country_id: 2635167
description:
85.203.46.136 - - [18/Jun/2026:14:40:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210723&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793623 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.46.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24210: 535 Incorrect authentication data (set_id=ot)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:40:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18058: 535 Incorrect authentication data (set_id=forti)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:41:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34884: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:41:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32532: 535 Incorrect authentication data (set_id=limbo)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.20.141
country_id: 2363686
domain: portail.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"color: rgb(0, 0, 0);\">bonjour m. gamal,</span></p><p><span style=\"color: rgb(0, 0, 0);\">veuillez trouver en pi\xc3\xa8ce jointe le devis pour le remplacement de l'alimentation du lecteur entr\xc3\xa9e personnel pour validation.</span></p><p><span style=\"color: rgb(0, 0, 0);\">en attente de votre retour...</span></p><p><span style=\"color: rgb(0, 0, 0);\">bien \xc3\xa0 vous!</span></p><p><br></p>||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:41:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4604: 535 Incorrect authentication data (set_id=maxine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:41:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19548: 535 Incorrect authentication data (set_id=other)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ba5f842c7df0b8df8a39a9114959f5638649d85||Title:0x18ff01b1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:41:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41034: 535 Incorrect authentication data (set_id=mapr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:41:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21818: 535 Incorrect authentication data (set_id=*.us)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:42:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42834: 535 Incorrect authentication data (set_id=cae)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:42:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36236: 535 Incorrect authentication data (set_id=competitions)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.82.99.148
country_id: 6252001
description:
23.82.99.148 - - [18/Jun/2026:14:42:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920394&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYy5hb3VkZS5jQHJjdS5nb3Yuc2E%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793762 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Yy5hb3VkZS5jQHJjdS5nb3Yuc2E=" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.82.99.148


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6395aadef6736bc0674e0981e44a2ec7b5b24b3b||Title:0xdb628d7c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:42:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65368: 535 Incorrect authentication data (set_id=ucrm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:42:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11030: 535 Incorrect authentication data (set_id=svt)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.19.119
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-42.37.63.19.119||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64088: 535 Incorrect authentication data (set_id=domainadmin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:42:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62510: 535 Incorrect authentication data (set_id=combat)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17274: 535 Incorrect authentication data (set_id=cae)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:43:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61798: 535 Incorrect authentication data (set_id=httpd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.238.122.158
country_id: 2921044
description:
[2026-06-18 14:43:27 +0000] info [webmaild] 195.238.122.158 - rappels@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:43:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38726: 535 Incorrect authentication data (set_id=melina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:43:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51696: 535 Incorrect authentication data (set_id=u15)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:43:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:12472: 535 Incorrect authentication data (set_id=confluence)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:43:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37866: 535 Incorrect authentication data (set_id=burn)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-18 14:43:34 +0000] info [cpaneld] 45.61.130.187 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:44:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34188: 535 Incorrect authentication data (set_id=proftpd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.134
country_id: 1269750
description:
Jun 18 14:44:18 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:830cbd46ccab9882f0baea60674f85b7c1e8cdc2||Title:0x7a97b44c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:44:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10522: 535 Incorrect authentication data (set_id=mazari)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 196.75.130.10
country_id: 2542007
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\r\n  <fault>\r\n    <value>\r\n      <struct>\r\n        <member>\r\n          <name>faultCode</name>\r\n          <value><int>403</int></value>\r\n        </member>\r\n        <member>\r\n          <name>faultString</name>\r\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\r\n        </member>\r\n      </struct>\r\n    </value>\r\n  </fault>\r\n</methodResponse>\r\n||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:44:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10812: 535 Incorrect authentication data (set_id=majka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:44:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49122: 535 Incorrect authentication data (set_id=ageorge)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dcddc2f3d0325755d523532c7ea78e22c6583195||Title:0xd9b8a92b||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38332: 535 Incorrect authentication data (set_id=aec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:44:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2388: 535 Incorrect authentication data (set_id=nakanishi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:44:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55622: 535 Incorrect authentication data (set_id=whitelist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:45:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44384: 535 Incorrect authentication data (set_id=office1)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:46:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19500: 535 Incorrect authentication data (set_id=ical)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:45:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35258: 535 Incorrect authentication data (set_id=projekty)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:45:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53368: 535 Incorrect authentication data (set_id=aws)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:45:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5436: 535 Incorrect authentication data (set_id=emeeting)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ebff613ee40234c5364176d3af1a33eb72cff15e||Title:0x328c1625||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.210
country_id: 1269750
description:
Jun 18 14:45:36 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:45:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51382: 535 Incorrect authentication data (set_id=his)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:45:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31616: 535 Incorrect authentication data (set_id=masco)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:46:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7630: 535 Incorrect authentication data (set_id=db02)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:46:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64156: 535 Incorrect authentication data (set_id=gracie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:46:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31240: 535 Incorrect authentication data (set_id=aftermarket-robotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:46:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20520: 535 Incorrect authentication data (set_id=onlinetest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:46:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7700: 535 Incorrect authentication data (set_id=cpanel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2463145ea4b64d5710fcd1c639527f9fc4e66fda||Title:0x0486c267||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:46:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29108: 535 Incorrect authentication data (set_id=earnest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:47:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44426: 535 Incorrect authentication data (set_id=pc104)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:47:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14504: 535 Incorrect authentication data (set_id=tata)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.65.162.158
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2019/09/COMMUNIQUE-CCR-AGRI.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ca7ef30fa0f3c750d961466dd7583cf632efd14||Title:0x64444752||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:47:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45052: 535 Incorrect authentication data (set_id=administration)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:47:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61210: 535 Incorrect authentication data (set_id=logger)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:47:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36554: 535 Incorrect authentication data (set_id=ccla)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:47:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19480: 535 Incorrect authentication data (set_id=milena)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.150.175.94
country_id: 2921044
description:
[2026-06-18 14:47:38 +0000] info [cpaneld] 45.150.175.94 - fgbegmfv "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:48:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20586: 535 Incorrect authentication data (set_id=teszt123)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 193.34.225.19
country_id: 1527747
domain: snb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70166.snb.tg||ServerName:snb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2c67854a00dad527190492df5c197d2ddd84dce||Title:0x7116efc2||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:49:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34702: 535 Incorrect authentication data (set_id=blog)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:48:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64380: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:48:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39048: 535 Incorrect authentication data (set_id=shenyang)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:49:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13408: 535 Incorrect authentication data (set_id=true)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:48:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12874: 535 Incorrect authentication data (set_id=veeam)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c87dfbfe5c8189029f1548b767361aaba3d66e3||Title:0x69601f12||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:48:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21048: 535 Incorrect authentication data (set_id=agglutinative)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:50:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:50:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.122.27
country_id: 2635167
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:198.105.122.27||TA:198.105.122.27||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:49:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62190: 535 Incorrect authentication data (set_id=bil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:49:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33802: 535 Incorrect authentication data (set_id=tosho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:49:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64886: 535 Incorrect authentication data (set_id=proba)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:50:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:49:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41884: 535 Incorrect authentication data (set_id=test1234)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e766ee858182ddfaa1aefb8b358d59502749ca8a||Title:0x3a9e8dd8||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:49:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41448: 535 Incorrect authentication data (set_id=freebsd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:49:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26490: 535 Incorrect authentication data (set_id=blog)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:18092: 535 Incorrect authentication data (set_id=john2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:50:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2514: 535 Incorrect authentication data (set_id=hola)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.76.154.7
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1270438500 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63838: 535 Incorrect authentication data (set_id=admision)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:50:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48308: 535 Incorrect authentication data (set_id=bab)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:50:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17688: 535 Incorrect authentication data (set_id=telep)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:da61efc799614ce7e3a307feb9790d22355f866f||Title:0xc6a3dd41||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:50:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52462: 535 Incorrect authentication data (set_id=student11)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.217.229.119
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1267097633 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:51:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55354: 535 Incorrect authentication data (set_id=zzj)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:51:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39116: 535 Incorrect authentication data (set_id=I've)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:52:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30404: 535 Incorrect authentication data (set_id=duclair)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:51:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6208: 535 Incorrect authentication data (set_id=s5)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:51:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28648: 535 Incorrect authentication data (set_id=marek)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:51:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787994&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794300 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:51:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8092: 535 Incorrect authentication data (set_id=asif)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:14:51:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973032&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794301 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 14:51:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:51:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37172: 535 Incorrect authentication data (set_id=koroleva)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.181.163.129
country_id: 6252001
description:
[2026-06-18 14:51:57 +0000] info [webmaild] 195.181.163.129 - sahondo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:52:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31600: 535 Incorrect authentication data (set_id=toucan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:53:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22954: 535 Incorrect authentication data (set_id=pannello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:52:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15468: 535 Incorrect authentication data (set_id=poopoo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:52:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44446: 535 Incorrect authentication data (set_id=mktg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48934: 535 Incorrect authentication data (set_id=nomura)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:52:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30694: 535 Incorrect authentication data (set_id=sysopr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56244: 535 Incorrect authentication data (set_id=bookworm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:53:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17464: 535 Incorrect authentication data (set_id=casement)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:53:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20710: 535 Incorrect authentication data (set_id=test01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:53:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63612: 535 Incorrect authentication data (set_id=scan1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:53:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51632: 535 Incorrect authentication data (set_id=titans)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:54:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20596: 535 Incorrect authentication data (set_id=quadra)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:54:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24882: 535 Incorrect authentication data (set_id=pctest)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:54:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:54:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41712: 535 Incorrect authentication data (set_id=testvm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:54:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27722: 535 Incorrect authentication data (set_id=itm)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:54:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:54:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39724: 535 Incorrect authentication data (set_id=temp8)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:54:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:54:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23286: 535 Incorrect authentication data (set_id=nagios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:54:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16862: 535 Incorrect authentication data (set_id=verizon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:55:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13780: 535 Incorrect authentication data (set_id=walter)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [18/Jun/2026:14:55:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673065&pdata=https%253A%252F%252Fcafe.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794543 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:55:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2658: 535 Incorrect authentication data (set_id=racing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:55:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65516: 535 Incorrect authentication data (set_id=cakes)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [18/Jun/2026:14:55:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134235&pdata=https%253A%252F%252Fcfmi.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794544 HTTP/2.0" 302 0 cfmi.tg "https://cfmi.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:55:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57666: 535 Incorrect authentication data (set_id=energia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:55:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4032: 535 Incorrect authentication data (set_id=pc4)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [18/Jun/2026:14:55:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000485&pdata=https%253A%252F%252Fns5mail.netmaster.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794550 HTTP/2.0" 302 0 ns5mail.netmaster.tg "https://ns5mail.netmaster.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.109.103.118
country_id: 1819730
description:
[2026-06-18 14:56:17 +0000] info [webmaild] 103.109.103.118 - support@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 91.210.248.232
country_id: 690791
domain: sotranetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34546.sotranetogo.com||ServerName:sotranetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:729ec6728242d1b9ce56bdf925c306d9408c2859||Title:0xcbf355f0||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:55:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15784: 535 Incorrect authentication data (set_id=shenyang)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:55:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9914: 535 Incorrect authentication data (set_id=racing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:56:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26262: 535 Incorrect authentication data (set_id=berenisthebest.qualitylearning.registry.dev)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.16.206.69
country_id: 953987
description:
[2026-06-18 14:56:59 +0000] info [webmaild] 154.16.206.69 - ptitrikou@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [18/Jun/2026:14:56:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924044&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794581 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:56:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34112: 535 Incorrect authentication data (set_id=roki)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:56:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40790: 535 Incorrect authentication data (set_id=sandeep)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:56:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58756: 535 Incorrect authentication data (set_id=servicos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:56:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17620: 535 Incorrect authentication data (set_id=chu-tin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:56:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32460: 535 Incorrect authentication data (set_id=orion)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63134: 535 Incorrect authentication data (set_id=name1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:57:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58202: 535 Incorrect authentication data (set_id=dan2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:57:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8484: 535 Incorrect authentication data (set_id=monica)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:57:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10046: 535 Incorrect authentication data (set_id=1234567891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35144: 535 Incorrect authentication data (set_id=mailadmin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:57:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:61616: 535 Incorrect authentication data (set_id=allusers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:58:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33544: 535 Incorrect authentication data (set_id=mg1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:58:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34380: 535 Incorrect authentication data (set_id=vpn1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [18/Jun/2026:14:58:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050601&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsenegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794713 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:58:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27682: 535 Incorrect authentication data (set_id=fle)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:58:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6254: 535 Incorrect authentication data (set_id=vpn1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:58:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42902: 535 Incorrect authentication data (set_id=hebe)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37822: 535 Incorrect authentication data (set_id=jaya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:58:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49110: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 18 14:58:41 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.81.124.84
country_id: 6252001
description:
[2026-06-18 14:59:11 +0000] info [cpaneld] 185.81.124.84 - test "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:59:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36226: 535 Incorrect authentication data (set_id=rotor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:59:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62182: 535 Incorrect authentication data (set_id=globalflash)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:59:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60506: 535 Incorrect authentication data (set_id=arpwatch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.137.228.169
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/887c77 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:59:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9904: 535 Incorrect authentication data (set_id=apt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:59:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2502: 535 Incorrect authentication data (set_id=recording)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:59:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24314: 535 Incorrect authentication data (set_id=manushi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.88.98.130
country_id: 6251999
description:
[2026-06-18 15:00:12 +0000] info [webmaild] 149.88.98.130 - iway@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:00:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30598: 535 Incorrect authentication data (set_id=marta)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:00:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855343&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794854 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:15:00:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985884&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794856 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:00:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32848: 535 Incorrect authentication data (set_id=hoho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:00:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42918: 535 Incorrect authentication data (set_id=badmail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:00:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4710: 535 Incorrect authentication data (set_id=nws)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:00:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52878: 535 Incorrect authentication data (set_id=spc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:00:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14440: 535 Incorrect authentication data (set_id=mailroot)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:01:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6728: 535 Incorrect authentication data (set_id=ester)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:01:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3458: 535 Incorrect authentication data (set_id=rz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:01:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17872: 535 Incorrect authentication data (set_id=w11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:01:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61764: 535 Incorrect authentication data (set_id=servers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:01:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55110: 535 Incorrect authentication data (set_id=charles)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:01:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18130: 535 Incorrect authentication data (set_id=charles)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 165.101.222.46
country_id: 1210997
description:
165.101.222.46 - - [18/Jun/2026:15:02:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869163&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-180091detid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794923 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-180091detid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:165.101.222.46


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:01:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59442: 535 Incorrect authentication data (set_id=user001)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.180.106
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:session-ordinaire-2021-litra-cloture-les-comptes-de-lexercice-2020-et-evalue-les-activites-2021-a-mi-parcours/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:02:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5272: 535 Incorrect authentication data (set_id=testing3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:02:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58714: 535 Incorrect authentication data (set_id=kathy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:02:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43460: 535 Incorrect authentication data (set_id=rock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:02:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58760: 535 Incorrect authentication data (set_id=communications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:02:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20604: 535 Incorrect authentication data (set_id=itservice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:02:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30186: 535 Incorrect authentication data (set_id=qwerasdfzxcv1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:03:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39282: 535 Incorrect authentication data (set_id=respaldo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:03:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:6430: 535 Incorrect authentication data (set_id=bpm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:03:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3774: 535 Incorrect authentication data (set_id=pg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:03:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61224: 535 Incorrect authentication data (set_id=pgsql)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:03:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64220: 535 Incorrect authentication data (set_id=contest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:04:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11020: 535 Incorrect authentication data (set_id=wozniak)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:04:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13056: 535 Incorrect authentication data (set_id=minside)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:04:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27956: 535 Incorrect authentication data (set_id=minside)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:04:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40436: 535 Incorrect authentication data (set_id=aris)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.130.70.245
country_id: 1210997
description:
114.130.70.245 - - [18/Jun/2026:15:04:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579861&pdata=https%253A%252F%252Ftogodailynews.tg%252Fopportunites-commerciales-entre-les-etats-unis-et-lafrique-prosper-africa-et-afreximbank-annoncent-un-nouveau-partenariat&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781795087 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/opportunites-commerciales-entre-les-etats-unis-et-lafrique-prosper-africa-et-afreximbank-annoncent-un-nouveau-partenariat" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.130.70.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.14.78
country_id: 6252001
description:
[2026-06-18 15:05:06 +0000] info [cpaneld] 195.63.14.78 - libertepansel "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:04:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43130: 535 Incorrect authentication data (set_id=samsung1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:04:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37378: 535 Incorrect authentication data (set_id=kurokawa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:04:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51488: 535 Incorrect authentication data (set_id=dfs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:04:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56464: 535 Incorrect authentication data (set_id=borisov)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.39.149.156
country_id: 3865483
domain: www.certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.certlogisticstogo.com/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:05:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16722: 535 Incorrect authentication data (set_id=member2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:05:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64636: 535 Incorrect authentication data (set_id=functions)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:05:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28598: 535 Incorrect authentication data (set_id=pacific)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.173.112.211
country_id: 6252001
description:
[2026-06-18 15:05:47 +0000] info [webmaild] 107.173.112.211 - contact@dany2.mairie.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User contact@dany2.mairie.tg has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.40.106.19
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/exposition-CEATA.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/06/exposition-CEATA-300x223.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/exposition-CEATA-768x571.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.251.223
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.45.140.251.223||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:05:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39100: 535 Incorrect authentication data (set_id=cost)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.249.4
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-05.45.140.249.4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:05:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7546: 535 Incorrect authentication data (set_id=email3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:05:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3812: 535 Incorrect authentication data (set_id=andres)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.250.193
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-05.45.140.250.193||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.181.28.82
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/10/33005-le-gouvernement-tient-son-premier-sminaire.png 600w, http:/togodailynews.tg/wp-content/uploads/2020/10/33005-le-gouvernement-tient-son-premier-sminaire-300x200.png 300w, http:/togodailynews.tg/wp-content/uploads/2020/10/33005-le-gouvernement-tient-son-premier-sminaire-272x182.png 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.140.248.151
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-06.45.140.248.151||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:06:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40386: 535 Incorrect authentication data (set_id=atp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:06:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31370: 535 Incorrect authentication data (set_id=kosik)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:06:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25056: 535 Incorrect authentication data (set_id=tajnica)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:06:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30190: 535 Incorrect authentication data (set_id=izumi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.180.208.155
country_id: 6252001
description:
[2026-06-18 15:07:15 +0000] info [cpaneld] 5.180.208.155 - richard "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:06:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57618: 535 Incorrect authentication data (set_id=mkaiser)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36666: 535 Incorrect authentication data (set_id=wq)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:07:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12846: 535 Incorrect authentication data (set_id=virginie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:07:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20442: 535 Incorrect authentication data (set_id=web0f1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:07:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12916: 535 Incorrect authentication data (set_id=auriga)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:07:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60732: 535 Incorrect authentication data (set_id=npd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:07:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26336: 535 Incorrect authentication data (set_id=teknik)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:07:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22188: 535 Incorrect authentication data (set_id=teknik)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:07:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42652: 535 Incorrect authentication data (set_id=nugget)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.249.214
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:45.140.249.214||TA:45.140.249.214||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:08:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53754: 535 Incorrect authentication data (set_id=modid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:08:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62958: 535 Incorrect authentication data (set_id=acc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:08:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61040: 535 Incorrect authentication data (set_id=oliver)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:08:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51320: 535 Incorrect authentication data (set_id=lillian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:08:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:7998: 535 Incorrect authentication data (set_id=cdn1)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:08:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:08:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:08:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21854: 535 Incorrect authentication data (set_id=testportal)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:08:34 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:09:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30024: 535 Incorrect authentication data (set_id=aj)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:09:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43512: 535 Incorrect authentication data (set_id=autofocus)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.135.42.49
country_id: 1168579
description:
139.135.42.49 - - [18/Jun/2026:15:09:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070488&pdata=https%253A%252F%252Ftogodailynews.tg%252Fclimat-des-affaires-un-environnement-favorable-aux-ide&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781795369 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/climat-des-affaires-un-environnement-favorable-aux-ide" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.135.42.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:09:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27704: 535 Incorrect authentication data (set_id=hohoho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:09:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53258: 535 Incorrect authentication data (set_id=banger)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:09:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35474: 535 Incorrect authentication data (set_id=warhol)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.245.152.35
country_id: 6252001
description:
[2026-06-18 15:10:14 +0000] info [cpaneld] 216.245.152.35 - togoinrdceh "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:09:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9606: 535 Incorrect authentication data (set_id=bernardo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.32.165.130
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1203257870 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.196.101
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/525351 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:10:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50242: 535 Incorrect authentication data (set_id=origin-user)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:11:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10624: 535 Incorrect authentication data (set_id=opname)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:10:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42042: 535 Incorrect authentication data (set_id=tula)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:10:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29326: 535 Incorrect authentication data (set_id=cache1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58996: 535 Incorrect authentication data (set_id=rmendoza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:10:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11528: 535 Incorrect authentication data (set_id=myob)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:10:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64644: 535 Incorrect authentication data (set_id=craig)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.245.152.35
country_id: 6252001
description:
[2026-06-18 15:10:53 +0000] info [cpaneld] 216.245.152.35 - ftchabagna "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:11:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23506: 535 Incorrect authentication data (set_id=film)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:11:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41312: 535 Incorrect authentication data (set_id=pg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:11:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29942: 535 Incorrect authentication data (set_id=opname)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:11:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55052: 535 Incorrect authentication data (set_id=kv)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:11:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27280: 535 Incorrect authentication data (set_id=bibliomedmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:11:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32848: 535 Incorrect authentication data (set_id=wizard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:12:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63888: 535 Incorrect authentication data (set_id=sftptest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:12:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:61738: 535 Incorrect authentication data (set_id=programming)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:12:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5948: 535 Incorrect authentication data (set_id=oso)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:12:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4280: 535 Incorrect authentication data (set_id=root.ns1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:12:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9196: 535 Incorrect authentication data (set_id=eset)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:12:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21896: 535 Incorrect authentication data (set_id=flight)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:13:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3330: 535 Incorrect authentication data (set_id=bfn2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:13:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11726: 535 Incorrect authentication data (set_id=banger)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:13:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28216: 535 Incorrect authentication data (set_id=veneto)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.216.116.50
country_id: 6252001
description:
[2026-06-18 15:14:20 +0000] info [cpaneld] 217.216.116.50 - togoinrdceh "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.158.207.147
country_id: 2542007
description:
[2026-06-18 15:14:00 +0000] info [cpaneld] 105.158.207.147 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:14:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30528: 535 Incorrect authentication data (set_id=conchi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:13:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45016: 535 Incorrect authentication data (set_id=demo01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:13:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47406: 535 Incorrect authentication data (set_id=loans)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:13:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38028: 535 Incorrect authentication data (set_id=jms)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:14:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43852: 535 Incorrect authentication data (set_id=tomo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:14:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2392: 535 Incorrect authentication data (set_id=rau)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d24875cea53a3ba267473f00a247f7d6ebca4cf||Title:kfwupwe8g5kxniv||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:14:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21130: 535 Incorrect authentication data (set_id=annmarie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:14:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60918: 535 Incorrect authentication data (set_id=lada)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.119
country_id: 732800
description:
Jun 18 15:14:43 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:14:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14212: 535 Incorrect authentication data (set_id=matomo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.53.228.200
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/432929187 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10206: 535 Incorrect authentication data (set_id=anagazanders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 15:15:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31248: 535 Incorrect authentication data (set_id=portail)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:16:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791847&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781795776 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c74ef8793c8caad49347ef53756d9c523f290645||Title:6jak63emhsint1i||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 15:15:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:54706: 535 Incorrect authentication data (set_id=esports)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:15:16:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246701&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781795775 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 15:15:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33230: 535 Incorrect authentication data (set_id=gms)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 15:15:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39194: 535 Incorrect authentication data (set_id=bkupexec)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.231.158.152
country_id: 285570
description:
37.231.158.152 - - [18/Jun/2026:15:15:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792152&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprogramme-presidentiel-dexcellence-lancement-de-la-deuxieme-promotion%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781795748 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/programme-presidentiel-dexcellence-lancement-de-la-deuxieme-promotion/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.6967.1594 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.231.158.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 15:15:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47280: 535 Incorrect authentication data (set_id=nik)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 15:15:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1570: 535 Incorrect authentication data (set_id=bart)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.220.89.186
country_id: 3469034
description:
2026-06-18 15:16:58 dovecot_plain authenticator failed for H=([10.5.0.2]) [179.220.89.186]:42396: 535 Incorrect authentication data (set_id=newsletter@togointerim.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cefb8af57320d995d19f8d49ba2ff8f87ff743e2||Title:sf0g414zbdrpxuczte||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.16.151.75
country_id: 2510769
description:
95.16.151.75 - - [18/Jun/2026:15:18:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246690&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdeclaration-de-lome-le-togo-et-lafcac-relancent-le-ciel-africain-integre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781795888 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/declaration-de-lome-le-togo-et-lafcac-relancent-le-ciel-africain-integre/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.8296.1732 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.16.151.75


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1f95521fb23f94abd2e1a2d7b40d6b95f235c51||Title:r9fqdj0yaci6qzo||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c66f07111db9899c942657005e7eaace223da80||Title:wppyfssn51no71||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.168
country_id: 1643084
description:
[2026-06-18 15:18:30 +0000] info [whostmgrd] 185.213.83.168 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.38.123.37
country_id: 6252001
description:
[2026-06-18 15:19:19 +0000] info [cpaneld] 65.38.123.37 - tout-ti "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.188.94.183
country_id: 2542007
description:
105.188.94.183 - - [18/Jun/2026:15:19:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171483&pdata=https%253A%252F%252Feducplusmedia.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781795959 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/contact/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.1333.1249 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.188.94.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.114
country_id: 3469034
description:
Jun 18 15:20:16 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.168
country_id: 1643084
description:
[2026-06-18 15:20:01 +0000] info [whostmgrd] 185.213.83.168 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.213.83.168
country_id: 1643084
description:
[2026-06-18 15:20:05 +0000] info [whostmgrd] 185.213.83.168 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:20de2eb84e68d59dfe59940c89d222c54ad19554||Title:ok2r5qcf1xo2j8wx||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.122
country_id: 2635167
description:
[2026-06-18 15:19:52 +0000] info [cpaneld] 5.230.153.122 NEW hgfdcvbnk:Qi_GHrvXgRkmx0zS address=5.230.153.122,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea4c6f10eafc4012f18ae2929d57de07635d5e46||Title:obnuuxbpjktd5aj2||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.199.2.45
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1559444597 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [18/Jun/2026:15:21:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948883&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781796080 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-18 15:22:14 +0000] info [webmaild] 160.242.195.10 - etchonda@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b432c92e28abb78c6b121e1ae2e8d301d921b087||Title:y1yabv6z37jvjbiat||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.228.234
country_id: 2661886
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:92.112.228.234||TA:92.112.228.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.168.118.95
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.168.118.95||TA:104.168.118.95||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.42.0.140
country_id: 6252001
description:
[2026-06-18 15:21:36 +0000] info [cpaneld] 193.42.0.140 - rdlizssu "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:76d21f68c459f4dac68784e6f229ca9bf62b6189||Title:tboc1rbulh8ny0||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:23:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:23:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:24:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4394e37584b9b2cabbbf4c6b88427cc793757d4a||Title:je4s5f9f0lihxiawmq||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le ciel africain s'ouvre un peu plus vers une int\xc3\xa9gration totale. dans le cadre de la convention et de l'exposition africaines du transport a\xc3\xa9rien, la capitale togolaise a abrit\xc3\xa9 un \xc3\xa9v\xc3\xa9nement majeur pour l'aviation continentale. le mercredi 17 juin 2026, le togo et la commission africaine de l\xe2\x80\x99aviation civile (cafac) ont officiellement scell\xc3\xa9 une convention d\xe2\x80\x99application pour renforcer la mise en \xc5\x93uvre du march\xc3\xa9 unique du transport a\xc3\xa9rien africain (mutaa).</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>un tournant d\xc3\xa9cisif dans l\xe2\x80\x99op\xc3\xa9rationnalisation du mutaa, vient d\xe2\x80\x99\xc3\xaatre marqu\xc3\xa9 avec la signature \xc3\xa0 lom\xc3\xa9 de la convention d\xe2\x80\x99application de cette initiative phare de l'union africaine, entre le togo et la commission africaine de l\xe2\x80\x99aviation civile (cafac).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la signature de cette convention, intervenue au troisi\xc3\xa8me jour des travaux \xc3\xa0 lom\xc3\xa9, a \xc3\xa9t\xc3\xa9 paraph\xc3\xa9e par le ministre togolais en charge des transport, komlan loukou-kadj\xc3\xa9, et le secr\xc3\xa9taire g\xc3\xa9n\xc3\xa9ral de la cafac, adefonke adeyemi.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"566px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:566px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ladite d\xc3\xa9marche vise \xc3\xa0 consolider la <em>d\xc3\xa9claration de lom\xc3\xa9 sur les d\xc3\xa9fis et l\xe2\x80\x99avenir du transport a\xc3\xa9rien africain</em>. l'ambition affich\xc3\xa9e est claire : faire tomber les barri\xc3\xa8res protectionnistes, faciliter les liaisons directes entre les nations s\xc5\x93urs du continent, renforcer la comp\xc3\xa9titivit\xc3\xa9 des compagnies a\xc3\xa9riennes locales et, \xc3\xa0 terme, faire baisser le co\xc3\xbbt des billets d'avion en afrique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que loin d'\xc3\xaatre une simple formalit\xc3\xa9 administrative, cet accord s'accompagne d'outils de gouvernance rigoureux pour garantir son succ\xc3\xa8s. le ministre komla loukou-kadj\xc3\xa9 a annonc\xc3\xa9 la mise en place imm\xc3\xa9diate d'une feuille de route assortie d\xe2\x80\x99un plan d\xe2\x80\x99action concret pour suivre les progr\xc3\xa8s technologiques et r\xc3\xa9glementaires.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab nous voulons que le ciel africain soit ouvert et nous voulons que toutes les compagnies puissent travailler librement d\xe2\x80\x99un pays \xc3\xa0 l\xe2\x80\x99autre \xc2\xbb,</em> a r\xc3\xa9affirm\xc3\xa9 le ministre des transports.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour s'assurer du respect des engagements pris, des r\xc3\xa9unions minist\xc3\xa9rielles p\xc3\xa9riodiques seront organis\xc3\xa9es dans l\xe2\x80\x99optique d'\xc3\xa9valuer le niveau d'ex\xc3\xa9cution du plan et de r\xc3\xa9ajuster les prochaines \xc3\xa9tapes du processus d'int\xc3\xa9gration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>lanc\xc3\xa9 en 2018, le mutaa est un projet de l\xe2\x80\x99agenda 2063 de l\xe2\x80\x99union africaine, dont le togo est l'un des pays champions historiques. ce projet phare de l\xe2\x80\x99ua vise \xc3\xa0 lib\xc3\xa9raliser le ciel africain, promouvoir la connectivit\xc3\xa9 entre les pays et soutenir le d\xc3\xa9veloppement \xc3\xa9conomique par un transport a\xc3\xa9rien plus fluide et comp\xc3\xa9titif.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:23:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le ciel africain s'ouvre un peu plus vers une int\xc3\xa9gration totale. dans le cadre de la convention et de l'exposition africaines du transport a\xc3\xa9rien, la capitale togolaise a abrit\xc3\xa9 un \xc3\xa9v\xc3\xa9nement majeur pour l'aviation continentale. le mercredi 17 juin 2026, le togo et la commission africaine de l\xe2\x80\x99aviation civile (cafac) ont officiellement scell\xc3\xa9 une convention d\xe2\x80\x99application pour renforcer la mise en \xc5\x93uvre du march\xc3\xa9 unique du transport a\xc3\xa9rien africain (mutaa).</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>un tournant d\xc3\xa9cisif dans l\xe2\x80\x99op\xc3\xa9rationnalisation du mutaa, vient d\xe2\x80\x99\xc3\xaatre marqu\xc3\xa9 avec la signature \xc3\xa0 lom\xc3\xa9 de la convention d\xe2\x80\x99application de cette initiative phare de l'union africaine, entre le togo et la commission africaine de l\xe2\x80\x99aviation civile (cafac).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la signature de cette convention, intervenue au troisi\xc3\xa8me jour des travaux \xc3\xa0 lom\xc3\xa9, a \xc3\xa9t\xc3\xa9 paraph\xc3\xa9e par le ministre togolais en charge des transport, komlan loukou-kadj\xc3\xa9, et le secr\xc3\xa9taire g\xc3\xa9n\xc3\xa9ral de la cafac, adefonke adeyemi.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"566px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:566px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ladite d\xc3\xa9marche vise \xc3\xa0 consolider la <em>d\xc3\xa9claration de lom\xc3\xa9 sur les d\xc3\xa9fis et l\xe2\x80\x99avenir du transport a\xc3\xa9rien africain</em>. l'ambition affich\xc3\xa9e est claire : faire tomber les barri\xc3\xa8res protectionnistes, faciliter les liaisons directes entre les nations s\xc5\x93urs du continent, renforcer la comp\xc3\xa9titivit\xc3\xa9 des compagnies a\xc3\xa9riennes locales et, \xc3\xa0 terme, faire baisser le co\xc3\xbbt des billets d'avion en afrique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que loin d'\xc3\xaatre une simple formalit\xc3\xa9 administrative, cet accord s'accompagne d'outils de gouvernance rigoureux pour garantir son succ\xc3\xa8s. le ministre komla loukou-kadj\xc3\xa9 a annonc\xc3\xa9 la mise en place imm\xc3\xa9diate d'une feuille de route assortie d\xe2\x80\x99un plan d\xe2\x80\x99action concret pour suivre les progr\xc3\xa8s technologiques et r\xc3\xa9glementaires.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab nous voulons que le ciel africain soit ouvert et nous voulons que toutes les compagnies puissent travailler librement d\xe2\x80\x99un pays \xc3\xa0 l\xe2\x80\x99autre \xc2\xbb,</em> a r\xc3\xa9affirm\xc3\xa9 le ministre des transports.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour s'assurer du respect des engagements pris, des r\xc3\xa9unions minist\xc3\xa9rielles p\xc3\xa9riodiques seront organis\xc3\xa9es dans l\xe2\x80\x99optique d'\xc3\xa9valuer le niveau d'ex\xc3\xa9cution du plan et de r\xc3\xa9ajuster les prochaines \xc3\xa9tapes du processus d'int\xc3\xa9gration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31156,\"width\":\"582px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/cf280d22-5566-4950-b6b8-986b4a8db8fc-724x1024.jpg\" alt=\"\" class=\"wp-image-31156\" style=\"width:582px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>lanc\xc3\xa9 en 2018, le mutaa est un projet de l\xe2\x80\x99agenda 2063 de l\xe2\x80\x99union africaine, dont le togo est l'un des pays champions historiques. ce projet phare de l\xe2\x80\x99ua vise \xc3\xa0 lib\xc3\xa9raliser le ciel africain, promouvoir la connectivit\xc3\xa9 entre les pays et soutenir le d\xc3\xa9veloppement \xc3\xa9conomique par un transport a\xc3\xa9rien plus fluide et comp\xc3\xa9titif.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6962233f35c6d63fbfae3c74d40ad43f6970fb32||Title:ydctwetr5bgmthgq||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 143.137.166.48
country_id: 6252001
domain: ekeasarl.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/130.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.227.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85cfa494e4edf7463c0954f97a1a6a3d743c7517||Title:sejcecevw57ivuh||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.168
country_id: 1643084
description:
[2026-06-18 15:25:45 +0000] info [whostmgrd] 185.213.83.168 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.9.35.115
country_id: 1643084
description:
182.9.35.115 - - [18/Jun/2026:15:26:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378330&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-renforcement-de-laxe-lome-tokyo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781796398 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-renforcement-de-laxe-lome-tokyo/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.4452.1204 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.9.35.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.249.5
country_id: 3469034
description:
Jun 18 15:26:37 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.249.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.168
country_id: 3017382
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.523517365622120.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.168
country_id: 1643084
description:
[2026-06-18 15:27:15 +0000] info [whostmgrd] 185.213.83.168 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.224.128
country_id: 6252001
description:
[2026-06-18 15:27:21 +0000] info [cpaneld] 45.134.224.128 - testsave "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.168
country_id: 1643084
description:
[2026-06-18 15:28:37 +0000] info [whostmgrd] 185.213.83.168 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.243.85
country_id: 798544
description:
Jun 18 15:28:59 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.243.85 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [18/Jun/2026:15:32:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12962198&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsenegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781796724 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:15:32:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986089&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781796750 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:32:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077843&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781796745 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-18 15:32:28 +0000] info [cpaneld] 173.211.89.140 NEW doufelg:IfdSk7HW8I_zdxAW address=173.211.89.140,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 118.101.206.190
country_id: 1733045
description:
118.101.206.190 - - [18/Jun/2026:15:33:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791599&pdata=https%253A%252F%252Fcivilemagazine.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781796810 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.1057.1516 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:118.101.206.190


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.206.124.253
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:206.206.124.253||TA:206.206.124.253||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 119.157.76.30
country_id: 1168579
description:
[2026-06-18 15:34:50 +0000] info [cpaneld] 119.157.76.30 NEW dmmkifel:g0PxIAAiuxyosDWY address=119.157.76.30,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [18/Jun/2026:15:36:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12752231&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fclicks-pharmacy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781797012 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/clicks-pharmacy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:38:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:38:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:38:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.124.59.10
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-20-1024x695-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-20-1024x695-1-300x204.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/07/B2PhotoA-20-1024x695-1-768x521.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:38:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.143
country_id: 3017382
description:
[2026-06-18 15:38:53 +0000] info [cpaneld] 5.231.64.143 NEW wwayrzpl:xSBfR4gMhY3K3C3J address=5.231.64.143,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.183.2.35
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/secretaire.jpg 500w, http:/togodailynews.tg/wp-content/uploads/2020/11/secretaire-300x199.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.59.209.93
country_id: 1210997
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/www.sunu-group.com HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.76.223
country_id: 2363686
description:
[2026-06-18 15:47:53 +0000] info [cpaneld] 196.170.76.223 NEW jvrzfkho:cVjyY8Sy7b_5OYFC address=196.170.76.223,app=cpaneld,creator=jvrzfkho,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-18 15:48:29 +0000] info [cpaneld] 185.55.240.13 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:48:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604393&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781797727 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:15:48:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857225&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781797729 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.89.45.54
country_id: 3658394
description:
190.89.45.54 - - [18/Jun/2026:15:49:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184851&pdata=https%253A%252F%252Ftogodailynews.tg%252F%253Fp%253D21319&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781797750 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/?p=21319" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.89.45.54


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.111.154
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/une-delegation-americaine-en-immersion-culturelle-au-togo/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:meta.ast-page-background-meta.desktop.background-color||MV:var(--ast-global-color-5)||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.211.168.154
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible XSS in arguments||MV:[{\"id\":\"519490ff\",\"eltype\":\"container\",\"settings\":{\"margin\":{\"unit\":\"px\",\"top\":\"0\",\"right\":0,\"bottom\":\"0\",\"left\":0,\"islinked\":false},\"padding\":{\"unit\":\"px\",\"top\":\"100\",\"right\":\"0\",\"bottom\":\"100\",\"left\":\"0\",\"islinked\":false},\"ekit_all_conditions_list\":[{\"_id\":\"675918e\"}],\"ekit_section_parallax_multi_items\":[],\"ekit_cursor_text_label\":\"elementskit cursor\",\"flex_direction\":\"column\",\"flex_align_items\":\"stretch\",\"flex_gap\":{\"size\":10,\"column\":\"10\",\"row\":\"10\",\"unit\":\"px\",\"islinked\":true}},\"elements\":[{\"id\":\"46546c00\",\"eltype\":\"widget\",\"settings\":{\"ekit_heading_title\":\"modern image box\",\"ekit_heading_sub_title\":\"time has changed\",\"ekit_heading_title_align\":\"center\",\"ekit_heading_seperator_width\":{\"unit\":\"px\",\"size\":\"40\",\"sizes\":[]},\"_margin\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"0\",\"bottom\":\"40\",\"left\":\"0\",\"islinked\":\"\"},\"ekit_heading_section_extra_title_show\":\"yes\",\"ekit_heading_extra_title\":\"<p><span style=\\\"font-weight: 400\\\">give your images modern look with elementor modern image box.<\\/span><\\/p>\",\"shadow_text_content\":\"bussiness\",\"ekit_all_conditions_list\":[{\"_id\":\"8aeaf27\"}],\"ekit_heading_seperator_image\":{\"id\":\"\",\"url\":\"https:\\/\\/camilliens.tg\\/wp-content\\/plugins\\/elementor\\/assets\\/images\\/placeholder.png\"},\"ekit_adv_tooltip_content\":\"tooltip content.\",\"ekit_cursor_text_label\":\"elementskit cursor\"},\"elements\":[],\"widgettype\":\"elementskit-heading\"},{\"id\":\"10e2fb04\",\"eltype\":\"container\",\"settings\":{\"structure\":\"30\",\"ekit_all_conditions_list\":[{\"_id\":\"e02bbad\"}],\"ekit_section_parallax_multi_items\":[],\"ekit_cursor_text_label\":\"elementskit cursor\",\"flex_direction\":\"row\",\"flex_align_items\":\"stretch\",\"flex_gap\":{\"size\":10,\"column\":\"10\",\"row\":\"10\",\"unit\":\"px\",\"islinked\":true},\"content_width\":\"full\",\"container_type\":\"grid\",\"presettitle\":\"grid\",\"preseticon\":\"eicon-container-grid\",\"grid_rows_grid\":{\"unit\":\"fr\",\"size\":1,\"sizes\":[]}},\"elements\":[{\"id\":\"2c3d08f6\",\"eltype\":\"widget\",\"settings\":{\"ekit_image_box_image\":{\"id\":274,\"url\":\"https:\\/\\/camilliens.tg\\/wp-content\\/uploads\\/2026\\/06\\/image-accordion-10.jpg\"},\"ekit_image_box_title_text\":\"this is the heading\",\"ekit_image_box_description_text\":\"trying to add add image box to your wordpress sites? no worries! \",\"ekit_image_box_btn_text\":\"\",\"ekit_image_box_icon\":\"icon icon-right-arrow2\",\"ekit_image_box_text_padding\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"0\",\"bottom\":\"0\",\"left\":\"0\",\"islinked\":\"1\"},\"ekit_image_box_btn_icon_font_size\":{\"unit\":\"px\",\"size\":\"18\"},\"ekit_image_box_button_text_color\":\"#2575fc\",\"ekit_image_box_btn_background_group_background\":\"classic\",\"ekit_image_box_btn_background_group_color\":\"rgba(0,0,0,0)\",\"ekit_image_box_btn_border_radius\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"0\",\"bottom\":\"0\",\"left\":\"0\",\"islinked\":\"1\"},\"ekit_imagebox_container_border_group_border\":\"solid\",\"ekit_imagebox_container_border_group_width\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"1\",\"bottom\":\"1\",\"left\":\"1\",\"islinked\":\"\"},\"ekit_imagebox_container_border_group_color\":\"#f5f5f5\",\"ekit_image_box_heading_color\":\"#000000\",\"ekit_image_box_thumbnail_custom_dimension\":{\"width\":\"20\",\"height\":\"20\"},\"ekit_image_box_style_simple\":\"style-modern\",\"ekit_image_box_enable_btn\":\"\",\"ekit_image_box_image_classic_curves_width\":{\"unit\":\"%\",\"size\":\"90\"},\"ekit_all_conditions_list\":[{\"_id\":\"dde750a\"}],\"ekit_adv_tooltip_content\":\"tooltip content.\",\"ekit_cursor_text_label\":\"elementskit cursor\"},\"elements\":[],\"widgettype\":\"elementskit-image-box\"},{\"id\":\"39276810\",\"eltype\":\"widget\",\"settings\":{\"ekit_image_box_image\":{\"id\":275,\"url\":\"https:\\/\\/camilliens.tg\\/wp-content\\/uploads\\/2026\\/06\\/image-accordion-4.jpg\"},\"ekit_image_box_title_text\":\"this is the heading\",\"ekit_image_box_description_text\":\"want to customize elementor image box height? here we have the solution!\",\"ekit_image_box_btn_text\":\"\",\"ekit_image_box_icon\":\"icon icon-right-arrow2\",\"ekit_image_box_text_padding\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"0\",\"bottom\":\"0\",\"left\":\"0\",\"islinked\":\"1\"},\"ekit_image_box_btn_icon_font_size\":{\"unit\":\"px\",\"size\":\"18\"},\"ekit_image_box_button_text_color\":\"#2575fc\",\"ekit_image_box_btn_background_group_background\":\"classic\",\"ekit_image_box_btn_background_group_color\":\"rgba(0,0,0,0)\",\"ekit_image_box_btn_border_radius\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"0\",\"bottom\":\"0\",\"left\":\"0\",\"islinked\":\"1\"},\"ekit_imagebox_container_border_group_border\":\"solid\",\"ekit_imagebox_container_border_group_width\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"1\",\"bottom\":\"1\",\"left\":\"1\",\"islinked\":\"\"},\"ekit_imagebox_container_border_group_color\":\"#f5f5f5\",\"ekit_image_box_heading_color\":\"#000000\",\"ekit_image_box_thumbnail_custom_dimension\":{\"width\":\"20\",\"height\":\"20\"},\"ekit_image_box_style_simple\":\"style-modern\",\"ekit_image_box_enable_btn\":\"\",\"ekit_image_box_image_classic_curves_width\":{\"unit\":\"%\",\"size\":\"90\"},\"ekit_all_conditions_list\":[{\"_id\":\"bba77af\"}],\"ekit_adv_tooltip_content\":\"tooltip content.\",\"ekit_cursor_text_label\":\"elementskit cursor\"},\"elements\":[],\"widgettype\":\"elementskit-image-box\"},{\"id\":\"7df0bb60\",\"eltype\":\"widget\",\"settings\":{\"ekit_image_box_image\":{\"id\":276,\"url\":\"https:\\/\\/camilliens.tg\\/wp-content\\/uploads\\/2026\\/06\\/image-accordion-13.jpg\"},\"ekit_image_box_title_text\":\"this is the heading\",\"ekit_image_box_description_text\":\"do you know how to add elementor image box with button? \",\"ekit_image_box_btn_text\":\"\",\"ekit_image_box_icon\":\"icon icon-right-arrow2\",\"ekit_image_box_text_padding\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"0\",\"bottom\":\"0\",\"left\":\"0\",\"islinked\":\"1\"},\"ekit_image_box_btn_icon_font_size\":{\"unit\":\"px\",\"size\":\"18\"},\"ekit_image_box_button_text_color\":\"#2575fc\",\"ekit_image_box_btn_background_group_background\":\"classic\",\"ekit_image_box_btn_background_group_color\":\"rgba(0,0,0,0)\",\"ekit_image_box_btn_border_radius\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"0\",\"bottom\":\"0\",\"left\":\"0\",\"islinked\":\"1\"},\"ekit_imagebox_container_border_group_border\":\"solid\",\"ekit_imagebox_container_border_group_width\":{\"unit\":\"px\",\"top\":\"0\",\"right\":\"1\",\"bottom\":\"1\",\"left\":\"1\",\"islinked\":\"\"},\"ekit_imagebox_container_border_group_color\":\"#f5f5f5\",\"ekit_image_box_heading_color\":\"#000000\",\"ekit_image_box_thumbnail_custom_dimension\":{\"width\":\"20\",\"height\":\"20\"},\"ekit_image_box_style_simple\":\"style-modern\",\"ekit_image_box_enable_btn\":\"\",\"ekit_image_box_image_classic_curves_width\":{\"unit\":\"%\",\"size\":\"90\"},\"ekit_all_conditions_list\":[{\"_id\":\"df555a2\"}],\"ekit_adv_tooltip_content\":\"tooltip content.\",\"ekit_cursor_text_label\":\"elementskit cursor\"},\"elements\":[],\"widgettype\":\"elementskit-image-box\"}],\"isinner\":true}],\"isinner\":false}]||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.251.113
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:45.140.251.113||TA:45.140.251.113||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.188.218
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:191.101.188.218||TA:191.101.188.218||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:15:51:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051721&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781797865 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.133.214.192
country_id: 1733045
description:
115.133.214.192 - - [18/Jun/2026:15:52:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103642&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fenseignants-regionaux-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781797954 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/enseignants-regionaux-togo/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.5233.1902 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.133.214.192


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:54:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:15:54:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:54:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:15:54:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-18 15:54:58 +0000] info [cpaneld] 185.55.240.13 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.158.107.36
country_id: 2400553
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 18 15:58:22 ns5.netmaster.tg cpanel_fileman_hook[3042583]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user qfaclpeg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-18 15:58:41 +0000] info [cpaneld] 185.55.240.13 - heroes "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jun 18 16:00:23 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.231.231.245
country_id: 1562822
description:
171.231.231.245 - - [18/Jun/2026:15:59:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645650&pdata=https%253A%252F%252F24heureinfo.tg%252Fsante%252Fchr-dapaong-renforcement-continu-du-service-de-la-radiologie-en-equipements&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781798370 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/sante/chr-dapaong-renforcement-continu-du-service-de-la-radiologie-en-equipements" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.231.231.245


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.58.39.203
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1640703960 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jun 18 16:00:29 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.180.34
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Opportunit\xc3\xa9s d\xe2\x80\x99investissement\xc2\xa0: Lom\xc3\xa9 accueille l\xe2\x80\x99Africa executing meeting 2023||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 62.201.243.41
country_id: 99237
description:
62.201.243.41 - - [18/Jun/2026:16:03:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800227&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffinance-islamique-le-togo-annonce-le-remboursement-partiel-du-sukuk-etat-du-togo-650-2016-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781798582 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/finance-islamique-le-togo-annonce-le-remboursement-partiel-du-sukuk-etat-du-togo-650-2016-2026/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6804.1927 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:62.201.243.41


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.140.113.75
country_id: 3686110
description:
181.140.113.75 - - [18/Jun/2026:16:03:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000328&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F5%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781798630 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/5/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7841.1801 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.140.113.75


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:03:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726566&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781798619 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:16:03:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604230&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781798618 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:16:05:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802647&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781798756 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.73.137.218
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/images-2.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2024/11/images-2-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:07:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:07:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:07:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:07:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.76.138.143
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/Etsri.jpg 770w, http:/togodailynews.tg/wp-content/uploads/2020/11/Etsri-300x169.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/11/Etsri-768x432.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-18 16:08:55 +0000] info [cpaneld] 185.55.240.13 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [18/Jun/2026:16:11:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989987&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frobotique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781799101 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/robotique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.89
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-18.03.30-1-1024x461.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-18.03.30-1-300x135.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-18.03.30-1-768x346.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-26-at-18.03.30-1.jpeg 1040w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [18/Jun/2026:16:12:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857684&pdata=https%253A%252F%252Ftdn.tg%252Frepartition-centres-ecrit-ministere-economie-finances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781799173 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/repartition-centres-ecrit-ministere-economie-finances/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 47.237.214.102
country_id: 1880251
domain: batika.free.netmaster.tg
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.43
country_id: 3175395
description:
Jun 18 16:16:31 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.130.174.138
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/1er-mai-2024.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2024/05/1er-mai-2024-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/1er-mai-2024-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/05/1er-mai-2024-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:17:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314800&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781799472 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:16:17:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788712&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781799473 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:16:19:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937322&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781799583 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.243.99.180
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/11/Page-4-A.jpg 787w, http:/togodailynews.tg/wp-content/uploads/2022/11/Page-4-A-300x156.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/11/Page-4-A-768x400.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:22:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:22:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:22:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:22:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-18 16:25:01 +0000] info [cpaneld] 185.55.240.13 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.60
country_id: 6252001
description:
[2026-06-18 16:25:07 +0000] info [whostmgrd] 45.38.16.60 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-18 16:26:23 +0000] info [cpaneld] 185.55.240.13 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.51.92.1
country_id: 1282988
description:
202.51.92.1 - - [18/Jun/2026:16:25:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011751&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprojet-passco-la-phase-3-officiellement-lance-a-pesside-dans-la-keran%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781799924 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/projet-passco-la-phase-3-officiellement-lance-a-pesside-dans-la-keran/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.1362.1814 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.51.92.1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-18 16:26:10 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [27.71.21.70]:12565: 535 Incorrect authentication data (set_id=dbabima@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.60
country_id: 6252001
description:
[2026-06-18 16:26:26 +0000] info [whostmgrd] 45.38.16.60 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.60
country_id: 6252001
description:
[2026-06-18 16:28:11 +0000] info [whostmgrd] 45.38.16.60 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.100
country_id: 3469034
description:
2026-06-18 16:30:25 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.100]:48308: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.60
country_id: 6252001
description:
[2026-06-18 16:31:03 +0000] info [whostmgrd] 45.38.16.60 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.217.168
country_id: 1512440
description:
2026-06-18 16:31:15 H=([188.113.217.168]) [188.113.217.168]:26746 F=<John@4452.com> rejected RCPT <jean@zephyr.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.100
country_id: 3469034
description:
2026-06-18 16:30:31 dovecot_login authenticator failed for H=([192.168.15.9]) [104.28.152.100]:48308: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.50.233.173
country_id: 3658394
description:
200.50.233.173 - - [18/Jun/2026:16:32:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907492&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10279&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781800326 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10279" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.4238.1608 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.50.233.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:34:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199212&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781800453 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:16:34:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986604&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781800454 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:16:34:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012569&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781800497 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:36:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:36:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-18 16:36:41 +0000] info [cpaneld] 102.54.238.57 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:36:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.60
country_id: 6252001
description:
[2026-06-18 16:36:34 +0000] info [cpaneld] 45.38.16.60 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:36:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.142
country_id: 1880251
description:
47.128.119.142 - - [18/Jun/2026:16:36:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050188&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D11040&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781800602 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=11040" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.49.115.208
country_id: 1210997
description:
103.49.115.208 - - [18/Jun/2026:16:37:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186392&pdata=https%253A%252F%252F24heureinfo.tg%252F%253Fp%253D25950&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781800673 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/?p=25950" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.49.115.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-18 16:42:43 +0000] info [webmaild] 160.242.195.10 - tbassowa@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-18 16:44:10 +0000] info [cpaneld] 5.230.133.64 NEW vejjghdd:bGzb3RjGrXAQkD51 address=5.230.133.64,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [18/Jun/2026:16:44:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7261292&pdata=https%253A%252F%252Fvitrinenews.tg%252Fweb%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801079 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/web/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [18/Jun/2026:16:45:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235229&pdata=https%253A%252F%252Fvitrinenews.tg%252Fweb%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801129 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/web/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [18/Jun/2026:16:45:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015450&pdata=https%253A%252F%252Fvitrinenews.tg%252Fweb%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801134 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/web/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-18 16:47:21 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.29.172.4
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/12/IMG-20200728-WA0102.jpg 486w, http:/togodailynews.tg/wp-content/uploads/2021/12/IMG-20200728-WA0102-300x230.jpg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.170.114.210
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/WhatsApp-Image-2022-12-27-at-07.23.08-1-1024x767.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/WhatsApp-Image-2022-12-27-at-07.23.08-1-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/WhatsApp-Image-2022-12-27-at-07.23.08-1-768x575.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/12/WhatsApp-Image-2022-12-27-at-07.23.08-1.jpeg 1280w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.164.227.12
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/11/Communiqu\xc3\xa9-CEET.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081239&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801396 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:16:49:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169946&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801397 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:16:50:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619048&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801453 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.201.76.147
country_id: 290557
description:
87.201.76.147 - - [18/Jun/2026:16:50:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209434&pdata=https%253A%252F%252F24heureinfo.tg%252Fenvironnement%252Fpage%252F2&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801454 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/environnement/page/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.201.76.147


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [18/Jun/2026:16:50:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471836&pdata=https%253A%252F%252Fvitrinenews.tg%252Fweb%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801440 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/web/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:51:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:16:51:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 152.32.145.156
country_id: 1861060
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ygpdcalt/public_html/wp-includes/SimplePie/about.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:51:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:16:51:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 110.137.74.2
country_id: 1643084
description:
110.137.74.2 - - [18/Jun/2026:16:52:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854809&pdata=https%253A%252F%252F24heureinfo.tg%252Fsante%252Fsante-dr-gilbert-tsolenyanu-elu-a-la-tete-du-synphot%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781801575 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/sante/sante-dr-gilbert-tsolenyanu-elu-a-la-tete-du-synphot/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:110.137.74.2


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.164.70
country_id: 6252001
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/images/other/image-school-begin.jpg HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 109.204.62.18
country_id: 298795
description:
[2026-06-18 16:55:17 +0000] info [cpaneld] 109.204.62.18 NEW dmmkifel:gE526T1J9QQmYUaV address=109.204.62.18,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 138.199.60.176
country_id: 1880251
description:
[2026-06-18 16:56:53 +0000] info [cpaneld] 138.199.60.176 NEW dmmkifel:Z9kXCY5vC9xEX5Gh address=138.199.60.176,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.145.111
country_id: 587116
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/prubeneficial.tg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.199.60.176
country_id: 1880251
description:
[2026-06-18 16:56:43 +0000] info [cpaneld] 138.199.60.176 - dmmkifel "GET /cpsess0310670397/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [109.204.62.18] != Current IP Address [138.199.60.176]


