# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 20:55:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9376: 535 Incorrect authentication data (set_id=ua2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 20:55:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48136: 535 Incorrect authentication data (set_id=web-admin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 20:55:34 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 20:55:20 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 20:55:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39346: 535 Incorrect authentication data (set_id=enter@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 20:55:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38284: 535 Incorrect authentication data (set_id=wasim@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.252
country_id: 1880251
description:
43.173.179.252 - - [26/Jun/2026:20:57:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921387&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Fla-fondation-tony-elumelu-et-lue-sassocient-pour-soutenir-les-femmes-africaines%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782507425 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/societe/la-fondation-tony-elumelu-et-lue-sassocient-pour-soutenir-les-femmes-africaines/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.252


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.189.233
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/rencontre-trimestrielle-societe-nouvelle-de-boissons-et-partenaires HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 20:56:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42474: 535 Incorrect authentication data (set_id=sklad@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 20:56:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12514: 535 Incorrect authentication data (set_id=aqq123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 20:56:17 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 20:56:27 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 20:56:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50034: 535 Incorrect authentication data (set_id=hchong@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 20:56:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:15714: 535 Incorrect authentication data (set_id=temp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 20:57:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26234: 535 Incorrect authentication data (set_id=receptionist@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 20:57:17 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 20:57:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54772: 535 Incorrect authentication data (set_id=ittest@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 20:57:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47594: 535 Incorrect authentication data (set_id=jwkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 20:57:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53368: 535 Incorrect authentication data (set_id=stage1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 20:57:23 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 20:57:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52508: 535 Incorrect authentication data (set_id=anu@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 20:58:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11608: 535 Incorrect authentication data (set_id=nadal@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 20:58:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21828: 535 Incorrect authentication data (set_id=alert@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 20:58:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34812: 535 Incorrect authentication data (set_id=ceb@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.89.58.85
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/9fa5a2 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 20:58:12 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 20:58:32 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 20:58:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2402: 535 Incorrect authentication data (set_id=jwkim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 20:59:22 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 20:59:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58880: 535 Incorrect authentication data (set_id=nozawa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 20:59:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19376: 535 Incorrect authentication data (set_id=blog2@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.0.88.5
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/292548647 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 20:59:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10664: 535 Incorrect authentication data (set_id=zhangxp@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.129.173
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-55-milliards-fcfa-pour-moderniser-106-km-de-routes-en-2026/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.129.173
country_id: 587116
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-55-milliards-fcfa-pour-moderniser-106-km-de-routes-en-2026/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 130.49.11.66
country_id: 298795
domain: crepsad.tg
description:
IM360 WAF: Request body parsing error||err_msg:XML parsing error: XML: Failed to parse document.||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 20:59:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50038: 535 Incorrect authentication data (set_id=alexis@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:00:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59886: 535 Incorrect authentication data (set_id=zenek@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.88.166.214
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/07/Ecole-1.webp 600w, http:/togodailynews.tg/wp-content/uploads/2025/07/Ecole-1-300x187.webp 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:00:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26272: 535 Incorrect authentication data (set_id=backdoor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:00:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60072: 535 Incorrect authentication data (set_id=dixon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:00:18 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:00:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62616: 535 Incorrect authentication data (set_id=blaine@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:00:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35134: 535 Incorrect authentication data (set_id=pablo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:00:15 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 100.23.175.107
country_id: 6252001
description:
100.23.175.107 - - [26/Jun/2026:21:00:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250905&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F047f4398adc6c939552db8e9846b83ff%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782507638 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/047f4398adc6c939552db8e9846b83ff/index.php?cmd=login/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:100.23.175.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:01:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62942: 535 Incorrect authentication data (set_id=insta@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:01:29 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:01:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1918: 535 Incorrect authentication data (set_id=registrator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:01:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36210: 535 Incorrect authentication data (set_id=ilias@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:01:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56060: 535 Incorrect authentication data (set_id=qms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:01:19 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:02:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32374: 535 Incorrect authentication data (set_id=poker@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:02:16 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:02:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49374: 535 Incorrect authentication data (set_id=augustine@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:02:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19302: 535 Incorrect authentication data (set_id=null@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:02:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41826: 535 Incorrect authentication data (set_id=iwasaki@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:02:31 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:03:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60046: 535 Incorrect authentication data (set_id=hvac@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:03:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17638: 535 Incorrect authentication data (set_id=hms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:03:15 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:03:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4706: 535 Incorrect authentication data (set_id=catalin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:03:18 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:03:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29252: 535 Incorrect authentication data (set_id=bailey@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:04:22 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:04:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33536: 535 Incorrect authentication data (set_id=radmilo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:04:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42360: 535 Incorrect authentication data (set_id=gw5@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:04:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33308: 535 Incorrect authentication data (set_id=rrrrrrrrrr@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:04:19 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:04:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32278: 535 Incorrect authentication data (set_id=ffffffffff@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:04:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25570: 535 Incorrect authentication data (set_id=radmilo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:05:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18584: 535 Incorrect authentication data (set_id=gabi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:05:35 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:05:27 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:05:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53232: 535 Incorrect authentication data (set_id=progroomsales@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:05:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9482: 535 Incorrect authentication data (set_id=complete@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:05:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1834: 535 Incorrect authentication data (set_id=labels@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:06:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58788: 535 Incorrect authentication data (set_id=xero@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:06:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38770: 535 Incorrect authentication data (set_id=extranet2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:06:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62932: 535 Incorrect authentication data (set_id=prueba123@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.0.23
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/301547571 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:06:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29506: 535 Incorrect authentication data (set_id=spc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:06:26 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:06:17 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:07:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39064: 535 Incorrect authentication data (set_id=year@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:07:26 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:07:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48898: 535 Incorrect authentication data (set_id=greece@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:07:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15032: 535 Incorrect authentication data (set_id=kapital@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [26/Jun/2026:21:07:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146008&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782508036 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:07:23 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:07:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1640: 535 Incorrect authentication data (set_id=greece@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:07:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37166: 535 Incorrect authentication data (set_id=qmail@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.10.98.185
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/aeroport-de-lome-hausse-du-fret-aerien/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:08:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43876: 535 Incorrect authentication data (set_id=career@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:08:13 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:08:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22540: 535 Incorrect authentication data (set_id=vm4@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.159.74
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-projet-ephyto-ferme-ses-portes-que-retenir-des-acquis/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.72.176.129
country_id: 6252001
domain: cafeit.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/125.0.6422.60 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.119.23.81
country_id: 1210997
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/aeroport-de-lome-hausse-du-fret-aerien/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:08:22 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:08:35 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.196.81
country_id: 2363686
description:
[2026-06-26 21:08:39 +0000] info [webmaild] 196.168.196.81 - wiyao.g@inger.tg "GET /cpsess1729779657/3rdparty/roundcube/?_task=mail&_action=compose&_id=7046632476a3e56bfbf6d0 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.66.202] != Current IP Address [196.168.196.81]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.159.74
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-projet-ephyto-ferme-ses-portes-que-retenir-des-acquis/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:08:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41394: 535 Incorrect authentication data (set_id=francesco@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:08:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52230: 535 Incorrect authentication data (set_id=packaging@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [26/Jun/2026:21:09:43 +0000] "GET /favicon.ico HTTP/2.0" 415 587 togofarm.tg "https://togofarm.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146008&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782508036" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:09:17 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:09:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12054: 535 Incorrect authentication data (set_id=guest@123@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.181.9
country_id: 953987
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/41.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:09:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63284: 535 Incorrect authentication data (set_id=bbb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:09:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55980: 535 Incorrect authentication data (set_id=figo@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.234.222.246
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1634728145 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:09:30 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [26/Jun/2026:21:09:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146008&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782508036 HTTP/2.0" 404 159 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A365 Safari/600.1.4" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:09:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57788: 535 Incorrect authentication data (set_id=portable@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:10:01 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.42.107
country_id: 6252001
domain: mail.soroubat.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.soroubat.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:09:47 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:10:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48920: 535 Incorrect authentication data (set_id=er@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:10:18 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:10:27 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:10:31 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:10:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5240: 535 Incorrect authentication data (set_id=int@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:10:40 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:10:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8238: 535 Incorrect authentication data (set_id=beebee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:10:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33398: 535 Incorrect authentication data (set_id=int@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.163.250.48
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1155098744 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:10:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39548: 535 Incorrect authentication data (set_id=affiliate@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:11:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58952: 535 Incorrect authentication data (set_id=joanne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:11:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45288: 535 Incorrect authentication data (set_id=nana@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:11:28 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:11:15 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:11:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13356: 535 Incorrect authentication data (set_id=hannibal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:11:20 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:11:29 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:11:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:21378: 535 Incorrect authentication data (set_id=rosalinde@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.142.252.185
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1603706427 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:12:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25062: 535 Incorrect authentication data (set_id=jhonny@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:12:26 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:12:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46068: 535 Incorrect authentication data (set_id=aaronh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:12:40 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.188.137.244
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:12:15 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:12:15 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:12:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58760: 535 Incorrect authentication data (set_id=wallpaper@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.188.137.244
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:12:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32696: 535 Incorrect authentication data (set_id=cr2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:13:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8996: 535 Incorrect authentication data (set_id=jorg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:13:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22522: 535 Incorrect authentication data (set_id=faro@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:13:17 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:13:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22308: 535 Incorrect authentication data (set_id=serv-refi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:13:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37292: 535 Incorrect authentication data (set_id=msm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:13:31 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:14:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14414: 535 Incorrect authentication data (set_id=faro@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:13:19 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:13:27 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.128.11.95
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/551090916 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.199.241.163
country_id: 732800
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/resultats-provisoires-denis-sassou-nguesso-reelu-avec-plus-de-94/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:14:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59176: 535 Incorrect authentication data (set_id=keisha@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:14:24 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:14:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45724: 535 Incorrect authentication data (set_id=ypw@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:14:16 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.51.143.18
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/resultats-provisoires-denis-sassou-nguesso-reelu-avec-plus-de-94/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:14:21 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:14:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18138: 535 Incorrect authentication data (set_id=zy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:14:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41090: 535 Incorrect authentication data (set_id=renzo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:14:37 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:15:12 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:15:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58828: 535 Incorrect authentication data (set_id=aquiter@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:15:12 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:15:29 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:15:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25764: 535 Incorrect authentication data (set_id=sochi@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.3.94.63
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/75a2e7cda9824ac27d35a8d7a26d3947_XL.webp 602w, http:/togodailynews.tg/wp-content/uploads/2025/04/75a2e7cda9824ac27d35a8d7a26d3947_XL-300x200.webp 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:15:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21906: 535 Incorrect authentication data (set_id=info@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:15:20 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:15:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23574: 535 Incorrect authentication data (set_id=user9@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-26 21:16:00 +0000] info [cpaneld] 20.212.169.175 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:16:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64444: 535 Incorrect authentication data (set_id=sua@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:16:23 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:16:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42812: 535 Incorrect authentication data (set_id=shafique@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:16:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32180: 535 Incorrect authentication data (set_id=mit@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:16:25 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-06-26 21:16:28 +0000] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.60.47.58
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1816711992 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:16:24 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-06-26 21:16:26 +0000] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:16:29 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:16:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35076: 535 Incorrect authentication data (set_id=trashed@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:17:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:7670: 535 Incorrect authentication data (set_id=test1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:17:28 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:17:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14930: 535 Incorrect authentication data (set_id=bergen-gw2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:17:15 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:17:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32642: 535 Incorrect authentication data (set_id=policia@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-06-26 21:17:16 +0000] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-06-26 21:17:15 +0000] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:17:14 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:17:13 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:17:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44004: 535 Incorrect authentication data (set_id=test1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:17:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32570: 535 Incorrect authentication data (set_id=detail@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:18:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28246: 535 Incorrect authentication data (set_id=seema@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:18:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23312: 535 Incorrect authentication data (set_id=udo@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [26/Jun/2026:21:19:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538857&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782508746 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:18:16 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:18:44 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.102.47.141
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/08/images-1-2.webp 336w, http:/togodailynews.tg/wp-content/uploads/2025/08/images-1-2-300x134.webp 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:18:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38434: 535 Incorrect authentication data (set_id=mustang@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:18:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4974: 535 Incorrect authentication data (set_id=sofia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:18:35 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:19:24 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:19:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12050: 535 Incorrect authentication data (set_id=hr@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.129
country_id: 1880251
description:
47.128.121.129 - - [26/Jun/2026:21:20:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184802&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Frestriction-de-visas%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782508807 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/restriction-de-visas/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.56.70.173
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/07391314-3ab8-485f-8842-3e8e1564eb81-300x213.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/07391314-3ab8-485f-8842-3e8e1564eb81-1024x728.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/07391314-3ab8-485f-8842-3e8e1564eb81-768x546.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/07391314-3ab8-485f-8842-3e8e1564eb81.webp 1280w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.69
country_id: 3469034
description:
Jun 26 21:19:23 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:19:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35286: 535 Incorrect authentication data (set_id=redbull@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:19:22 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:19:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33682: 535 Incorrect authentication data (set_id=cvsup@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:19:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4452: 535 Incorrect authentication data (set_id=webstar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:19:28 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:20:22 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.25.4.20
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/832527150 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:20:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45166: 535 Incorrect authentication data (set_id=gtc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:20:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39094: 535 Incorrect authentication data (set_id=jeffery@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:20:32 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.74.102
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/245768239 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.46.203.32
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/940168836 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:20:18 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:20:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1928: 535 Incorrect authentication data (set_id=checkin@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:20:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31422: 535 Incorrect authentication data (set_id=america1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52682: 535 Incorrect authentication data (set_id=america1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:21:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42618: 535 Incorrect authentication data (set_id=apple@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:21:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61950: 535 Incorrect authentication data (set_id=ivanna@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.145.253.37
country_id: 2542007
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:21:13 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:21:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:24798: 535 Incorrect authentication data (set_id=israel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:21:19 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:21:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26730: 535 Incorrect authentication data (set_id=hr1@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.133.61.29
country_id: 3057568
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/ustogo/wwwhlmesppb.html HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:21:46 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:21:52 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:22:28 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30590: 535 Incorrect authentication data (set_id=turkey@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3110: 535 Incorrect authentication data (set_id=remy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:22:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45652: 535 Incorrect authentication data (set_id=rbeck@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:22:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10592: 535 Incorrect authentication data (set_id=riesgo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:22:33 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 155.229.89.35
country_id: 2635167
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/images-1-2.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:22:30 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:22:43 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:23:20 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:23:28 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:23:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51252: 535 Incorrect authentication data (set_id=at@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21840: 535 Incorrect authentication data (set_id=jiajia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:23:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42656: 535 Incorrect authentication data (set_id=chris1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:23:17 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:23:28 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35974: 535 Incorrect authentication data (set_id=vpn2@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:24:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20158: 535 Incorrect authentication data (set_id=oh@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 177.234.138.196
country_id: 1269750
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:177.234.138.196||TA:177.234.138.196||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.142.127.185
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1409949059 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:24:16 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:24:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62512: 535 Incorrect authentication data (set_id=lnp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:24:44 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:24:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11832: 535 Incorrect authentication data (set_id=rap's@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:24:18 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:24:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12168: 535 Incorrect authentication data (set_id=oh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:24:26 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:24:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58554: 535 Incorrect authentication data (set_id=scripts@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 26 21:25:13 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:25:18 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:25:29 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62816: 535 Incorrect authentication data (set_id=stagiaire@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-26 21:25:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34818: 535 Incorrect authentication data (set_id=eda@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.206.2
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1125859501 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:25:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49050: 535 Incorrect authentication data (set_id=smtp3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 26 21:25:49 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-26 21:25:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7372: 535 Incorrect authentication data (set_id=talks@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-26 21:26:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38978: 535 Incorrect authentication data (set_id=chop@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 26 21:26:28 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-26 21:26:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13336: 535 Incorrect authentication data (set_id=lic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 26 21:26:19 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.35.65.158
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/915304094 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.180.183
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1538335026 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.163.169.205
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/94295672 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.185.22.42
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/5 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.98.5.87
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-crise-du-cepes-quel-impact-sur-les-ecoles-esa-et-esgis/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.98.5.87
country_id: 2589581
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-crise-du-cepes-quel-impact-sur-les-ecoles-esa-et-esgis/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 100.23.175.107
country_id: 6252001
description:
100.23.175.107 - - [26/Jun/2026:21:31:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053989&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782509479 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:100.23.175.107


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 130.49.76.66
country_id: 798544
domain: v2.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Sx1caeFZim1j$w3d.v2.arse.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.116.216
country_id: 2363686
description:
[2026-06-26 21:36:34 +0000] info [webmaild] 196.168.116.216 - ldaro@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.208.224.174
country_id: 2921044
description:
92.208.224.174 - - [26/Jun/2026:21:37:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934024&pdata=https%253A%252F%252Fwebmail.inh.free.netmaster.tg%252F%253Flocale%253Dru&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782509832 HTTP/2.0" 302 0 webmail.inh.free.netmaster.tg "https://webmail.inh.free.netmaster.tg/?locale=ru" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.208.224.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.147
country_id: 3469034
description:
Jun 26 21:39:00 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.72
country_id: 3865483
description:
Jun 26 21:39:25 ns5 auth[524710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.72 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jun 26 21:42:43 ns5 sshd[659313]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.219
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.219: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.40.174
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.40.174: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.236
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.236: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.180.248
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.180.248: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.46.118
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.46.118: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.216.226.213
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.216.226.213: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.40.133
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.40.133: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.40.18
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.40.18: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.153
country_id: 3469034
description:
Jun 26 21:44:40 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.153 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.109.177.39
country_id: 2750405
description:
23.109.177.39 - - [26/Jun/2026:21:45:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130785&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252F2023%252F12%252F13%252Flinitiative-collaboratif-pour-lacces-aux-injectables-officiellement-lancee-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782510344 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/2023/12/13/linitiative-collaboratif-pour-lacces-aux-injectables-officiellement-lancee-a-lome/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.4920.1606 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.109.177.39


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 100.23.175.107
country_id: 6252001
description:
100.23.175.107 - - [26/Jun/2026:21:47:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381981&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e%252F35f1f35508db0f1f5637ad1622c8b6dd%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782510441 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e/35f1f35508db0f1f5637ad1622c8b6dd/index.php?cmd=newupld/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:100.23.175.107


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.168.249
country_id: 6252001
domain: mail.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.case-afrique.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.211.187
country_id: 3017382
domain: anamek.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.28.211.187||TA:104.28.211.187||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.187
country_id: 3017382
domain: anamek.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ljrwwgxg||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.197.147.52
country_id: 357994
description:
[2026-06-26 21:50:20 +0000] info [cpaneld] 62.197.147.52 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.206.175
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:140.99.206.175||TA:140.99.206.175||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.242.114.150
country_id: 6251999
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:196.242.114.150||TA:196.242.114.150||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.197.147.52
country_id: 357994
description:
[2026-06-26 21:55:18 +0000] info [cpaneld] 62.197.147.52 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 21:59:57 dovecot_login authenticator failed for H=(CHTt3o6Tq) [109.123.246.129]:49375: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.113.110
country_id: 953987
description:
2026-06-26 21:59:15 dovecot_login authenticator failed for H=(JnU08to0s) [102.22.113.110]:48910: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:00:15 dovecot_login authenticator failed for H=(92WuXPS) [109.123.246.129]:51349: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:01:14 dovecot_login authenticator failed for H=(7l22OQr2A) [109.123.246.129]:59808: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:02:19 dovecot_login authenticator failed for H=(OaUafC5V) [109.123.246.129]:60314: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.122.98.30
country_id: 3190538
description:
[2026-06-26 22:02:35 +0000] info [cpaneld] 46.122.98.30 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.122.98.30
country_id: 3190538
description:
46.122.98.30 - - [26/Jun/2026:22:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6409067&pdata=https%3A%2F%2Flacs1.mairie.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782511353 HTTP/1.1" 302 0 lacs1.mairie.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.122.98.30


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:03:08 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:03:31 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:03:33 dovecot_login authenticator failed for H=(ZH4gGiom4) [109.123.246.129]:58458: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:04:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:04:20 dovecot_login authenticator failed for H=(wrWmiJ3) [109.123.246.129]:50774: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:04:39 dovecot_login authenticator failed for H=(xcuwA7) [109.123.246.129]:55701: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 100.23.175.107
country_id: 6252001
description:
100.23.175.107 - - [26/Jun/2026:22:05:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802136&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782511522 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:100.23.175.107


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:05:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:05:20 dovecot_login authenticator failed for H=(6d5meKh) [109.123.246.129]:63992: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:06:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:06:25 dovecot_login authenticator failed for H=(s62Gx5b6i) [109.123.246.129]:64398: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:07:17 dovecot_login authenticator failed for H=(QnedzLbGP) [109.123.246.129]:57619: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:07:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:08:21 dovecot_login authenticator failed for H=(jJiGzzrmV) [109.123.246.129]:55965: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:09:07 dovecot_login authenticator failed for H=(XtX19T) [109.123.246.129]:50977: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:09:35 dovecot_login authenticator failed for H=(e0yGJNj) [109.123.246.129]:55017: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.164.128.150
country_id: 192950
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/71.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:10:17 dovecot_login authenticator failed for H=(RDWtwj) [109.123.246.129]:65497: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:11:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:11:21 dovecot_login authenticator failed for H=(5gmhtkw) [109.123.246.129]:61901: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:12:35 dovecot_login authenticator failed for H=(4i9SDxg) [109.123.246.129]:59095: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:12:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:13:16 dovecot_login authenticator failed for H=(LPXGybgsp) [109.123.246.129]:53069: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:13:14 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.127.2.114
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-14.209.127.2.114||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:14:50 dovecot_login authenticator failed for H=(stb8lt) [109.123.246.129]:55483: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:15:06 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:14:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account esp.togo@cafe.tg has been locked for the attacker IP 109.123.246.129


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:14:21 dovecot_login authenticator failed for H=(4YWz15ilz) [109.123.246.129]:50007: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:15:26 dovecot_login authenticator failed for H=(DmJ0YwUjI) [109.123.246.129]:51714: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.201.114.66
country_id: 2750405
domain: macite.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:15:24 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:16:35 dovecot_login authenticator failed for H=(9EeDns) [109.123.246.129]:50568: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:16:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:17:14 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:17:16 dovecot_login authenticator failed for H=(nRTNOh) [109.123.246.129]:59479: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:18:38 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.154.161.153
country_id: 1819730
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/le-cluster-kozah-celebre-la-journee-de-lenfant-africain/<script async src=||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:18:40 dovecot_login authenticator failed for H=(fKk8pX) [109.123.246.129]:59262: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.172
country_id: 1880251
description:
43.173.179.172 - - [26/Jun/2026:22:19:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184858&pdata=https%253A%252F%252Fwww.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782512342 HTTP/1.1" 404 561 www.arse.tg "https://www.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.172


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.68.180
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.68.180||TA:152.232.68.180||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:19:49 dovecot_login authenticator failed for H=(U1HS6s) [109.123.246.129]:59118: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:19:24 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:19:26 dovecot_login authenticator failed for H=(Z8RNDAIW) [109.123.246.129]:53974: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:20:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:20:25 dovecot_login authenticator failed for H=(cUkEcsct1t) [109.123.246.129]:61870: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.166.84
country_id: 2363686
description:
102.64.166.84 - - [26/Jun/2026:22:20:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947245&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2026%252F06%252F26%252Fagou-celebre-son-fils-edmond-yawo-amekusse-nomme-eveque-de-kpalime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782512430 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2026/06/26/agou-celebre-son-fils-edmond-yawo-amekusse-nomme-eveque-de-kpalime/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.166.84


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.103.86.156
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/3eme-edition-de-costumer-service-week-2022-togocom-plus-proche-de-sa-clientele/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:21:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.248.11
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/3eme-edition-de-costumer-service-week-2022-togocom-plus-proche-de-sa-clientele/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:21:21 dovecot_login authenticator failed for H=(phRk3Hh) [109.123.246.129]:60355: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.123.246.129
country_id: 3017382
description:
Jun 26 22:22:13 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.123.246.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.123.246.129
country_id: 3017382
description:
2026-06-26 22:22:15 dovecot_login authenticator failed for H=(Jol7gK) [109.123.246.129]:57169: 535 Incorrect authentication data (set_id=esp.togo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 85.208.115.126
country_id: 146669
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:85.208.115.126||TA:85.208.115.126||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.216.179
country_id: 241170
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/21e-anniversaire-du-rappel-a-Dieu-du-Pere-de-la-nation-une-veillee-de-priere-a-Pya-768x512.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.22.126.217
country_id: 2661886
description:
[2026-06-26 22:27:02 +0000] info [webmaild] 157.22.126.217 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.143.138.243
country_id: 2017370
description:
[2026-06-26 22:31:13 +0000] info [cpaneld] 188.143.138.243 - der "GET /login/?login_only=1&user=der&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user der (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.191
country_id: 3469034
description:
Jun 26 22:30:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.36.56
country_id: 3895114
description:
[2026-06-26 22:31:05 +0000] info [cpaneld] 181.43.36.56 - deroutg "GET /login/?login_only=1&user=deroutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deroutg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.172.16.153
country_id: 3865483
description:
[2026-06-26 22:30:58 +0000] info [cpaneld] 190.172.16.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.54.179.62
country_id: 2017370
description:
[2026-06-26 22:31:01 +0000] info [cpaneld] 185.54.179.62 - derou "GET /login/?login_only=1&user=derou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user derou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.144.78
country_id: 3469034
description:
[2026-06-26 22:31:16 +0000] info [cpaneld] 170.83.144.78 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.48.116.219
country_id: 3469034
description:
[2026-06-26 22:33:27 +0000] info [cpaneld] 179.48.116.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.1.182.185
country_id: 1733045
description:
[2026-06-26 22:33:31 +0000] info [cpaneld] 14.1.182.185 - derou "GET /login/?login_only=1&user=derou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user derou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.63.61.130
country_id: 1733045
description:
[2026-06-26 22:33:44 +0000] info [cpaneld] 182.63.61.130 - der "GET /login/?login_only=1&user=der&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user der (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.41.154
country_id: 3996063
description:
[2026-06-26 22:33:35 +0000] info [cpaneld] 45.142.41.154 - deroutg "GET /login/?login_only=1&user=deroutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deroutg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.7.219.71
country_id: 2017370
description:
[2026-06-26 22:33:47 +0000] info [cpaneld] 193.7.219.71 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.32.208.55
country_id: 2017370
description:
[2026-06-26 22:34:58 +0000] info [cpaneld] 212.32.208.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.132.92.25
country_id: 3686110
description:
[2026-06-26 22:35:01 +0000] info [cpaneld] 181.132.92.25 - groupgci "GET /login/?login_only=1&user=groupgci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user groupgci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.183.28.205
country_id: 3865483
description:
[2026-06-26 22:35:07 +0000] info [cpaneld] 190.183.28.205 - groupgcicom "GET /login/?login_only=1&user=groupgcicom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user groupgcicom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.152.163.214
country_id: 3658394
description:
[2026-06-26 22:35:09 +0000] info [cpaneld] 190.152.163.214 - groupgc "GET /login/?login_only=1&user=groupgc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user groupgc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.113.216.236
country_id: 1562822
description:
[2026-06-26 22:35:21 +0000] info [cpaneld] 42.113.216.236 - group "GET /login/?login_only=1&user=group&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user group (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.177.41
country_id: 290291
description:
[2026-06-26 22:35:26 +0000] info [cpaneld] 77.69.177.41 - grou "GET /login/?login_only=1&user=grou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user grou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.241.200.229
country_id: 3469034
description:
[2026-06-26 22:35:33 +0000] info [cpaneld] 191.241.200.229 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.28.117.27
country_id: 453733
description:
Jun 26 22:35:56 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.28.117.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.122.168.16
country_id: 2017370
description:
[2026-06-26 22:36:05 +0000] info [cpaneld] 91.122.168.16 - festicstg "GET /login/?login_only=1&user=festicstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festicstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.254.3.206
country_id: 102358
description:
[2026-06-26 22:36:11 +0000] info [cpaneld] 151.254.3.206 - festic "GET /login/?login_only=1&user=festic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festic (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 174.140.254.230
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:174.140.254.230||TA:174.140.254.230||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.95.169.132
country_id: 3469034
description:
[2026-06-26 22:35:14 +0000] info [cpaneld] 187.95.169.132 - groupg "GET /login/?login_only=1&user=groupg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user groupg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.139.135.214
country_id: 2017370
description:
[2026-06-26 22:35:28 +0000] info [cpaneld] 79.139.135.214 - gro "GET /login/?login_only=1&user=gro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.76.48.221
country_id: 1562822
description:
[2026-06-26 22:36:01 +0000] info [cpaneld] 115.76.48.221 - festics "GET /login/?login_only=1&user=festics&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festics (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.231.129.105
country_id: 3469034
description:
[2026-06-26 22:36:16 +0000] info [cpaneld] 170.231.129.105 - festi "GET /login/?login_only=1&user=festi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.42.237.102
country_id: 357994
description:
[2026-06-26 22:36:20 +0000] info [cpaneld] 197.42.237.102 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.246.13
country_id: 1282988
description:
[2026-06-26 22:36:28 +0000] info [cpaneld] 103.225.246.13 - fe "GET /login/?login_only=1&user=fe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.184.46.181
country_id: 3469034
description:
[2026-06-26 22:36:19 +0000] info [cpaneld] 45.184.46.181 - fest "GET /login/?login_only=1&user=fest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.117.61.144
country_id: 2017370
description:
[2026-06-26 22:36:22 +0000] info [cpaneld] 87.117.61.144 - fes "GET /login/?login_only=1&user=fes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.248.252.1
country_id: 2017370
description:
[2026-06-26 22:36:23 +0000] info [cpaneld] 109.248.252.1 - itstg "GET /login/?login_only=1&user=itstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user itstg (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 170.199.224.250
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:170.199.224.250||TA:170.199.224.250||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.114.33
country_id: 2017370
description:
[2026-06-26 22:36:27 +0000] info [cpaneld] 77.222.114.33 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.115.226.126
country_id: 6251999
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:161.115.226.126||TA:161.115.226.126||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.163.200.131
country_id: 3469034
description:
[2026-06-26 22:38:55 +0000] info [cpaneld] 164.163.200.131 - caseafriq "GET /login/?login_only=1&user=caseafriq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseafriq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.80.122.31
country_id: 3469034
description:
[2026-06-26 22:38:49 +0000] info [cpaneld] 170.80.122.31 - caseafriquetg "GET /login/?login_only=1&user=caseafriquetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseafriquetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.68.113
country_id: 290557
description:
[2026-06-26 22:39:05 +0000] info [cpaneld] 176.205.68.113 - caseaf "GET /login/?login_only=1&user=caseaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseaf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.126.219.138
country_id: 1210997
description:
[2026-06-26 22:38:52 +0000] info [cpaneld] 103.126.219.138 - caseafriqu "GET /login/?login_only=1&user=caseafriqu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseafriqu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.92.22.37
country_id: 458258
description:
[2026-06-26 22:39:02 +0000] info [cpaneld] 188.92.22.37 - caseafr "GET /login/?login_only=1&user=caseafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caseafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.102.151.192
country_id: 2589581
description:
[2026-06-26 22:39:07 +0000] info [cpaneld] 41.102.151.192 - casea "GET /login/?login_only=1&user=casea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.110.171.21
country_id: 3686110
description:
[2026-06-26 22:39:10 +0000] info [cpaneld] 200.110.171.21 - fbafricacom "GET /login/?login_only=1&user=fbafricacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafricacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.105.127.210
country_id: 2017370
description:
[2026-06-26 22:38:42 +0000] info [cpaneld] 95.105.127.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.61.113.126
country_id: 3469034
description:
[2026-06-26 22:39:05 +0000] info [cpaneld] 187.61.113.126 - fbafrica "GET /login/?login_only=1&user=fbafrica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafrica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.84.154.61
country_id: 3469034
description:
[2026-06-26 22:39:19 +0000] info [cpaneld] 170.84.154.61 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.50.217.224
country_id: 102358
description:
[2026-06-26 22:39:20 +0000] info [cpaneld] 188.50.217.224 - fbafr "GET /login/?login_only=1&user=fbafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.163.231
country_id: 2017370
description:
[2026-06-26 22:39:30 +0000] info [cpaneld] 95.26.163.231 - fb "GET /login/?login_only=1&user=fb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.138.231.10
country_id: 3469034
description:
[2026-06-26 22:39:13 +0000] info [cpaneld] 177.138.231.10 - case "GET /login/?login_only=1&user=case&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user case (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.121.107
country_id: 2017370
description:
[2026-06-26 22:39:16 +0000] info [cpaneld] 45.147.121.107 - fbafri "GET /login/?login_only=1&user=fbafri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.162.217
country_id: 3469034
description:
[2026-06-26 22:39:24 +0000] info [cpaneld] 168.196.162.217 - fbaf "GET /login/?login_only=1&user=fbaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbaf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.161.210.78
country_id: 3469034
description:
[2026-06-26 22:39:13 +0000] info [cpaneld] 177.161.210.78 - fbafric "GET /login/?login_only=1&user=fbafric&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafric (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.90
country_id: 3895114
description:
[2026-06-26 22:39:16 +0000] info [cpaneld] 179.60.74.90 - cas "GET /login/?login_only=1&user=cas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.19.32.191
country_id: 3686110
description:
[2026-06-26 22:39:27 +0000] info [cpaneld] 179.19.32.191 - fba "GET /login/?login_only=1&user=fba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.48.89.108
country_id: 1210997
description:
[2026-06-26 22:41:52 +0000] info [cpaneld] 182.48.89.108 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.10.90.148
country_id: 3469034
description:
[2026-06-26 22:41:56 +0000] info [cpaneld] 187.10.90.148 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.76.135
country_id: 3865483
description:
[2026-06-26 22:41:27 +0000] info [cpaneld] 45.189.76.135 - togodailynewstg "GET /login/?login_only=1&user=togodailynewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.177.162.240
country_id: 298795
description:
[2026-06-26 22:41:36 +0000] info [cpaneld] 78.177.162.240 - togodail "GET /login/?login_only=1&user=togodail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.167.183.53
country_id: 2017370
description:
[2026-06-26 22:41:19 +0000] info [cpaneld] 95.167.183.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.41.174.241
country_id: 3865483
description:
[2026-06-26 22:41:23 +0000] info [cpaneld] 179.41.174.241 - togodailynews "GET /login/?login_only=1&user=togodailynews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.174.115.242
country_id: 2017370
description:
[2026-06-26 22:41:46 +0000] info [cpaneld] 95.174.115.242 - togod "GET /login/?login_only=1&user=togod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togod (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.60.52.145
country_id: 3686110
description:
[2026-06-26 22:41:39 +0000] info [cpaneld] 190.60.52.145 - togodai "GET /login/?login_only=1&user=togodai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.66.39.38
country_id: 3469034
description:
[2026-06-26 22:41:30 +0000] info [cpaneld] 187.66.39.38 - togodailyn "GET /login/?login_only=1&user=togodailyn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailyn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.124.200.229
country_id: 3437598
description:
[2026-06-26 22:41:44 +0000] info [cpaneld] 181.124.200.229 - togoda "GET /login/?login_only=1&user=togoda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.129.25.128
country_id: 3469034
description:
[2026-06-26 22:41:59 +0000] info [cpaneld] 177.129.25.128 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.24.249
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/elections-legislatives-et-regionales-2024-la-haac-met-a-la-disposition-des-candidats-le-calendrier-de-passage-sur-les-medias/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.172.155.234
country_id: 953987
description:
[2026-06-26 22:43:02 +0000] info [cpaneld] 213.172.155.234 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.235.21.74
country_id: 3469034
description:
[2026-06-26 22:43:06 +0000] info [cpaneld] 45.235.21.74 - droitshumains "GET /login/?login_only=1&user=droitshumains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.20.1
country_id: 99237
description:
[2026-06-26 22:43:10 +0000] info [cpaneld] 169.224.20.1 - droitshumainstg "GET /login/?login_only=1&user=droitshumainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumainstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.71.174.192
country_id: 3469034
description:
[2026-06-26 22:43:30 +0000] info [cpaneld] 45.71.174.192 - droits "GET /login/?login_only=1&user=droits&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droits (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.78.100.32
country_id: 3017382
description:
[2026-06-26 22:43:32 +0000] info [cpaneld] 128.78.100.32 - droit "GET /login/?login_only=1&user=droit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.218.217
country_id: 3658394
description:
[2026-06-26 22:43:14 +0000] info [cpaneld] 177.234.218.217 - droitshuma "GET /login/?login_only=1&user=droitshuma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshuma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.195.202.173
country_id: 3865483
description:
[2026-06-26 22:43:21 +0000] info [cpaneld] 190.195.202.173 - droitshu "GET /login/?login_only=1&user=droitshu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.177.29.200
country_id: 2542007
description:
[2026-06-26 22:43:16 +0000] info [cpaneld] 160.177.29.200 - droitshum "GET /login/?login_only=1&user=droitshum&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshum (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.86.110.230
country_id: 3686110
description:
[2026-06-26 22:43:34 +0000] info [cpaneld] 186.86.110.230 - droi "GET /login/?login_only=1&user=droi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.79.88.73
country_id: 2542007
description:
[2026-06-26 22:43:40 +0000] info [cpaneld] 105.79.88.73 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.237.27.239
country_id: 3932488
description:
[2026-06-26 22:43:26 +0000] info [cpaneld] 190.237.27.239 - droitsh "GET /login/?login_only=1&user=droitsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.102.85.28
country_id: 3469034
description:
[2026-06-26 22:43:38 +0000] info [cpaneld] 187.102.85.28 - dro "GET /login/?login_only=1&user=dro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dro (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.219.168.232
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.219.168.232: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.137.75.57
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/e2affaa0f83d9c44300f73b8385e1610_L-300x200.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.208.101.242
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/e7d681ddc0174087ad0e36dc718519dd_L-300x225.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.213.230.138
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/IMG-20260621-WA0010-872x547-1-300x188.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.70.37.19
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/02da41c0223ab76d2a8745bc81de29d6_L-300x208.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.154.225
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/6eef6a2ca9885596df95dd4875db518c_L-300x194.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.11.115
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1P1A5069-300x200.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.221.27.12
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/6b15e20836ed1e2731b8b4faac93d68e_L-300x200.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.211.109.36
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/07391314-3ab8-485f-8842-3e8e1564eb81-300x213.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.211.5
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Kft59-300x200.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.51.166.210
country_id: 3469034
description:
[2026-06-26 22:45:40 +0000] info [cpaneld] 189.51.166.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.199.227.136
country_id: 1282988
description:
[2026-06-26 22:45:57 +0000] info [cpaneld] 113.199.227.136 - delx "GET /login/?login_only=1&user=delx&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delx (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.75.171.20
country_id: 3469034
description:
[2026-06-26 22:46:01 +0000] info [cpaneld] 177.75.171.20 - del "GET /login/?login_only=1&user=del&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user del (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.223.80
country_id: 3996063
description:
[2026-06-26 22:46:04 +0000] info [cpaneld] 187.188.223.80 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.197.17.20
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2023/03/334754357_5850584281704598_6766489006701372120_n-300x150.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.178
country_id: 3469034
description:
Jun 26 22:46:46 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.244
country_id: 3175395
description:
Jun 26 22:47:15 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.67.47
country_id: 2328926
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/journee-nationale-de-larbre-49-ans-apres-une-tradition-toujours-vivante-face-a-lurgence-ecologique/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.89.156
country_id: 3895114
description:
[2026-06-26 22:49:02 +0000] info [cpaneld] 186.189.89.156 - perfect "GET /login/?login_only=1&user=perfect&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfect (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.208.253.103
country_id: 3017382
description:
[2026-06-26 22:49:12 +0000] info [cpaneld] 109.208.253.103 - bawasongroupcom "GET /login/?login_only=1&user=bawasongroupcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroupcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.104.118
country_id: 1733045
description:
[2026-06-26 22:48:38 +0000] info [cpaneld] 115.134.104.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.234
country_id: 99237
description:
[2026-06-26 22:49:06 +0000] info [cpaneld] 212.237.119.234 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.67.47
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/journee-nationale-de-larbre-49-ans-apres-une-tradition-toujours-vivante-face-a-lurgence-ecologique/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.24.94.204
country_id: 2017370
description:
[2026-06-26 22:48:58 +0000] info [cpaneld] 81.24.94.204 - perfectl "GET /login/?login_only=1&user=perfectl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.151.227.32
country_id: 2017370
description:
[2026-06-26 22:49:04 +0000] info [cpaneld] 217.151.227.32 - perfec "GET /login/?login_only=1&user=perfec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.230.129.137
country_id: 3996063
description:
[2026-06-26 22:49:10 +0000] info [cpaneld] 189.230.129.137 - bawasongroup "GET /login/?login_only=1&user=bawasongroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroup (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.228.115.202
country_id: 2017370
description:
[2026-06-26 22:48:40 +0000] info [cpaneld] 185.228.115.202 - perfectlabo "GET /login/?login_only=1&user=perfectlabo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectlabo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.148.74.125
country_id: 1210997
description:
[2026-06-26 22:48:47 +0000] info [cpaneld] 103.148.74.125 - perfectlabocom "GET /login/?login_only=1&user=perfectlabocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectlabocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.239.229
country_id: 99237
description:
[2026-06-26 22:48:51 +0000] info [cpaneld] 62.201.239.229 - perfectlab "GET /login/?login_only=1&user=perfectlab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perfectlab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.68.163
country_id: 3865483
description:
[2026-06-26 22:49:40 +0000] info [cpaneld] 181.46.68.163 - bawas "GET /login/?login_only=1&user=bawas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.38.39.141
country_id: 3469034
description:
[2026-06-26 22:50:02 +0000] info [cpaneld] 189.38.39.141 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.187.45
country_id: 1210997
description:
[2026-06-26 22:49:41 +0000] info [cpaneld] 114.130.187.45 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.76.219
country_id: 1512440
description:
[2026-06-26 22:49:47 +0000] info [cpaneld] 84.54.76.219 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.18.13.27
country_id: 3469034
description:
[2026-06-26 22:49:52 +0000] info [cpaneld] 189.18.13.27 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.110.148.140
country_id: 2464461
description:
[2026-06-26 22:49:52 +0000] info [cpaneld] 154.110.148.140 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.124.52.40
country_id: 1210997
description:
[2026-06-26 22:49:13 +0000] info [cpaneld] 103.124.52.40 - perf "GET /login/?login_only=1&user=perf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user perf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.112.102.179
country_id: 3865483
description:
[2026-06-26 22:49:25 +0000] info [cpaneld] 190.112.102.179 - pe "GET /login/?login_only=1&user=pe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.50.66.235
country_id: 1282988
description:
[2026-06-26 22:49:29 +0000] info [cpaneld] 182.50.66.235 - tilitulab "GET /login/?login_only=1&user=tilitulab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.209.142.110
country_id: 3469034
description:
[2026-06-26 22:49:37 +0000] info [cpaneld] 179.209.142.110 - bawaso "GET /login/?login_only=1&user=bawaso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawaso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.95.198.167
country_id: 3017382
description:
[2026-06-26 22:49:45 +0000] info [cpaneld] 85.95.198.167 - baw "GET /login/?login_only=1&user=baw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user baw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.158.51.52
country_id: 3996063
description:
[2026-06-26 22:49:32 +0000] info [cpaneld] 189.158.51.52 - tilitulabtg "GET /login/?login_only=1&user=tilitulabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.236.142.217
country_id: 2017370
description:
[2026-06-26 22:49:43 +0000] info [cpaneld] 91.236.142.217 - bawa "GET /login/?login_only=1&user=bawa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.231.206
country_id: 1605651
description:
[2026-06-26 22:49:56 +0000] info [cpaneld] 184.22.231.206 - tili "GET /login/?login_only=1&user=tili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.177.55.120
country_id: 2661886
description:
[2026-06-26 22:49:58 +0000] info [cpaneld] 151.177.55.120 - til "GET /login/?login_only=1&user=til&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user til (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.248.151.252
country_id: 2921044
description:
[2026-06-26 22:49:26 +0000] info [cpaneld] 91.248.151.252 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.179.49.59
country_id: 1210997
description:
[2026-06-26 22:49:30 +0000] info [cpaneld] 118.179.49.59 - bawasong "GET /login/?login_only=1&user=bawasong&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasong (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.238.93.151
country_id: 6251999
description:
[2026-06-26 22:49:34 +0000] info [cpaneld] 173.238.93.151 - bawason "GET /login/?login_only=1&user=bawason&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawason (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.70.32.242
country_id: 285570
description:
[2026-06-26 22:49:37 +0000] info [cpaneld] 188.70.32.242 - tilitula "GET /login/?login_only=1&user=tilitula&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitula (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.21
country_id: 1880251
description:
43.172.195.21 - - [26/Jun/2026:22:50:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778518&pdata=http%253A%252F%252Ftogodailynews.tg%252Ffootball-le-togo-passe-le-premier-tour-premilinaire-du-mondial-2022%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782514239 HTTP/1.1" 404 561 togodailynews.tg "http://togodailynews.tg/football-le-togo-passe-le-premier-tour-premilinaire-du-mondial-2022/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.19.125.204
country_id: 2017370
description:
[2026-06-26 22:51:40 +0000] info [cpaneld] 195.19.125.204 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.62.37.246
country_id: 690791
description:
[2026-06-26 22:51:56 +0000] info [cpaneld] 195.62.37.246 - cato "GET /login/?login_only=1&user=cato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.98.12.205
country_id: 290557
description:
[2026-06-26 22:52:04 +0000] info [cpaneld] 86.98.12.205 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.188.36.32
country_id: 2542007
description:
[2026-06-26 22:51:43 +0000] info [cpaneld] 105.188.36.32 - catogo "GET /login/?login_only=1&user=catogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.191.80.123
country_id: 3865483
description:
[2026-06-26 22:51:48 +0000] info [cpaneld] 45.191.80.123 - catogoorg "GET /login/?login_only=1&user=catogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catogoorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.112.93.172
country_id: 3658394
description:
[2026-06-26 22:51:52 +0000] info [cpaneld] 181.112.93.172 - catog "GET /login/?login_only=1&user=catog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user catog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.104.90
country_id: 3658394
description:
[2026-06-26 22:52:01 +0000] info [cpaneld] 157.100.104.90 - cat "GET /login/?login_only=1&user=cat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cat (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.123.210.247
country_id: 1819730
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:190.123.210.247||TA:190.123.210.247||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.132.125.121
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:91.132.125.121||TA:91.132.125.121||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.141.234
country_id: 6252001
description:
[2026-06-26 22:53:28 +0000] info [cpaneld] 172.59.141.234 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.48.89.70
country_id: 6252001
description:
[2026-06-26 22:53:28 +0000] info [whostmgrd] 199.48.89.70 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.147.13
country_id: 6252001
description:
[2026-06-26 22:53:32 +0000] info [cpaneld] 73.23.147.13 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.185.90.227
country_id: 6252001
description:
[2026-06-26 22:53:34 +0000] info [whostmgrd] 47.185.90.227 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.165.28.38
country_id: 6252001
description:
[2026-06-26 22:53:39 +0000] info [cpaneld] 98.165.28.38 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.24.147.79
country_id: 6252001
description:
[2026-06-26 22:53:38 +0000] info [whostmgrd] 192.24.147.79 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.123.253.169
country_id: 1210997
description:
[2026-06-26 22:55:52 +0000] info [cpaneld] 27.123.253.169 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.14.154.250
country_id: 3625428
description:
[2026-06-26 22:56:04 +0000] info [cpaneld] 186.14.154.250 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.72.171.124
country_id: 2233387
description:
[2026-06-26 22:55:55 +0000] info [cpaneld] 154.72.171.124 - ceni "GET /login/?login_only=1&user=ceni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.229.21
country_id: 1512440
description:
[2026-06-26 22:56:08 +0000] info [cpaneld] 185.213.229.21 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.51.98.171
country_id: 3865483
description:
[2026-06-26 22:56:00 +0000] info [cpaneld] 170.51.98.171 - cenitg "GET /login/?login_only=1&user=cenitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.6.79
country_id: 3996063
description:
2026-06-26 22:57:30 dovecot_plain authenticator failed for H=fixed-189-203-6-79.totalplay.net ([69.172.210.47]) [189.203.6.79]:19508: 535 Incorrect authentication data (set_id=admin@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.12.182.17
country_id: 3469034
description:
2026-06-26 22:57:51 dovecot_plain authenticator failed for H=([69.172.210.47]) [177.12.182.17]:50388: 535 Incorrect authentication data (set_id=marketing@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.60.147
country_id: 1522867
description:
2026-06-26 22:58:07 dovecot_plain authenticator failed for H=([69.172.210.47]) [37.99.60.147]:5865: 535 Incorrect authentication data (set_id=contact@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.208.33.155
country_id: 2017370
description:
2026-06-26 22:57:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.208.33.155]:10215: 535 Incorrect authentication data (set_id=info@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.135.37.232
country_id: 953987
description:
2026-06-26 22:58:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [41.135.37.232]:59234: 535 Incorrect authentication data (set_id=financeiro@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.60.147
country_id: 1522867
description:
2026-06-26 22:58:14 dovecot_login authenticator failed for H=([69.172.210.47]) [37.99.60.147]:5865: 535 Incorrect authentication data (set_id=contact@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.46.68.48
country_id: 1512440
description:
2026-06-26 22:58:22 dovecot_plain authenticator failed for H=([69.172.210.47]) [95.46.68.48]:58240: 535 Incorrect authentication data (set_id=contato@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.37.1.79
country_id: 6252001
description:
2026-06-26 22:58:38 dovecot_plain authenticator failed for H=c-98-37-1-79.hsd1.ca.comcast.net ([69.172.210.47]) [98.37.1.79]:36280: 535 Incorrect authentication data (set_id=contacto@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.6.18.125
country_id: 3469034
description:
2026-06-26 22:59:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [191.6.18.125]:31815: 535 Incorrect authentication data (set_id=suporte@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.184.112.218
country_id: 3469034
description:
2026-06-26 23:00:12 dovecot_plain authenticator failed for H=link-startx-45-184-112-218.unirtelecom.com.br ([69.172.210.47]) [45.184.112.218]:50517: 535 Incorrect authentication data (set_id=hr@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.164.33.65
country_id: 1733045
description:
2026-06-26 22:59:39 dovecot_plain authenticator failed for H=([69.172.210.47]) [115.164.33.65]:58532: 535 Incorrect authentication data (set_id=accounts@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.3.81.94
country_id: 1562822
description:
2026-06-26 22:59:25 dovecot_plain authenticator failed for H=([69.172.210.47]) [27.3.81.94]:15189: 535 Incorrect authentication data (set_id=it@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.230.230.175
country_id: 3865483
description:
2026-06-26 23:00:32 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.230.230.175]:41662: 535 Incorrect authentication data (set_id=office@sproca.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 26 23:00:41 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.205.238.84
country_id: 290557
description:
2026-06-26 23:00:48 dovecot_plain authenticator failed for H=bba-176-205-238-84.alshamil.net.ae ([69.172.210.47]) [176.205.238.84]:53592: 535 Incorrect authentication data (set_id=soporte@sproca.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.4.57.219
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/developpement-a-la-base-16-342-auto-emplois-crees-entre-2024-et-2025/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.50.65.76
country_id: 290557
description:
2026-06-26 23:01:04 dovecot_plain authenticator failed for H=bba-2-50-65-76.alshamil.net.ae ([69.172.210.47]) [2.50.65.76]:54678: 535 Incorrect authentication data (set_id=ventas@sproca.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.40.38.236
country_id: 3895114
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/developpement-a-la-base-16-342-auto-emplois-crees-entre-2024-et-2025/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.184.112.218
country_id: 3469034
description:
2026-06-26 23:00:19 dovecot_login authenticator failed for H=link-startx-45-184-112-218.unirtelecom.com.br ([69.172.210.47]) [45.184.112.218]:50517: 535 Incorrect authentication data (set_id=hr@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.75.169.0
country_id: 3469034
description:
2026-06-26 23:01:35 dovecot_plain authenticator failed for H=189-75-169-0.user3p.v-tal.net.br ([69.172.210.47]) [189.75.169.0]:21210: 535 Incorrect authentication data (set_id=info@sproca.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.51.9.144
country_id: 3508796
description:
2026-06-26 23:01:19 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.51.9.144]:21729: 535 Incorrect authentication data (set_id=clients@sproca.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.141
country_id: 3469034
description:
Jun 26 23:02:51 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.223
country_id: 3469034
description:
Jun 26 23:03:14 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.28.143.124
country_id: 6254930
description:
[2026-06-26 23:04:24 +0000] info [cpaneld] 46.28.143.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.158.158.1
country_id: 1210997
description:
[2026-06-26 23:04:30 +0000] info [cpaneld] 103.158.158.1 - sprocatg "GET /login/?login_only=1&user=sprocatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sprocatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.67.2.113
country_id: 3932488
description:
[2026-06-26 23:04:39 +0000] info [cpaneld] 181.67.2.113 - spro "GET /login/?login_only=1&user=spro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.247.159.144
country_id: 2017370
description:
[2026-06-26 23:04:41 +0000] info [cpaneld] 87.247.159.144 - spr "GET /login/?login_only=1&user=spr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.16.185.116
country_id: 953987
description:
[2026-06-26 23:04:45 +0000] info [cpaneld] 165.16.185.116 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.148.157.228
country_id: 2017370
description:
[2026-06-26 23:04:50 +0000] info [cpaneld] 62.148.157.228 - horizonme "GET /login/?login_only=1&user=horizonme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.82.246
country_id: 3865483
description:
[2026-06-26 23:04:33 +0000] info [cpaneld] 45.236.82.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.187.3.103
country_id: 3932488
description:
[2026-06-26 23:04:47 +0000] info [cpaneld] 38.187.3.103 - horizonmed "GET /login/?login_only=1&user=horizonmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.186.99.167
country_id: 3469034
description:
[2026-06-26 23:04:57 +0000] info [cpaneld] 45.186.99.167 - horizon "GET /login/?login_only=1&user=horizon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.120.199
country_id: 1512440
description:
[2026-06-26 23:05:05 +0000] info [cpaneld] 84.54.120.199 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.66.187.2
country_id: 3686110
description:
[2026-06-26 23:04:27 +0000] info [cpaneld] 190.66.187.2 - sproca "GET /login/?login_only=1&user=sproca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.183.241.45
country_id: 3469034
description:
[2026-06-26 23:04:39 +0000] info [cpaneld] 45.183.241.45 - horizonmedical "GET /login/?login_only=1&user=horizonmedical&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedical (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.110.242.21
country_id: 953987
description:
[2026-06-26 23:04:52 +0000] info [cpaneld] 152.110.242.21 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.197.175
country_id: 3996063
description:
[2026-06-26 23:05:14 +0000] info [cpaneld] 187.190.197.175 - hor "GET /login/?login_only=1&user=hor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hor (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.137
country_id: 1880251
description:
43.173.182.137 - - [26/Jun/2026:23:06:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200278&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F25050&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782515207 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/25050" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.137


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.169.26.238
country_id: 2363686
domain: civilemagazine.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/10?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.53
country_id: 1880251
description:
47.128.112.53 - - [26/Jun/2026:23:07:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542043&pdata=https%253A%252F%252Fmisstogo.tg%252F2014%252F12%252F24%252Fnexus-6-review%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782515273 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/2014/12/24/nexus-6-review/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.53


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.85.167.88
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/laurent-tamegnon-demande-un-renforcement-des-mesures-economiques/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.32.73.118
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/laurent-tamegnon-demande-un-renforcement-des-mesures-economiques/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.153.104.196
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1844||QS:add-to-cart=1844||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.142.102
country_id: 3865483
description:
[2026-06-26 23:13:04 +0000] info [cpaneld] 186.22.142.102 - lepopu "GET /login/?login_only=1&user=lepopu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.89.90.70
country_id: 3469034
description:
[2026-06-26 23:12:42 +0000] info [cpaneld] 189.89.90.70 - lepopulistetogo "GET /login/?login_only=1&user=lepopulistetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.233.154.3
country_id: 3686110
description:
[2026-06-26 23:12:44 +0000] info [cpaneld] 181.233.154.3 - lepopulistetogotg "GET /login/?login_only=1&user=lepopulistetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.109.76.184
country_id: 3469034
description:
[2026-06-26 23:12:49 +0000] info [cpaneld] 190.109.76.184 - lepopulist "GET /login/?login_only=1&user=lepopulist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.242.26
country_id: 1210997
description:
[2026-06-26 23:13:00 +0000] info [cpaneld] 103.134.242.26 - lepopul "GET /login/?login_only=1&user=lepopul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.96.145.82
country_id: 3865483
description:
[2026-06-26 23:12:38 +0000] info [cpaneld] 181.96.145.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.7.167.111
country_id: 3469034
description:
[2026-06-26 23:12:54 +0000] info [cpaneld] 201.7.167.111 - lepopulis "GET /login/?login_only=1&user=lepopulis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.206.106.111
country_id: 2542007
description:
[2026-06-26 23:12:57 +0000] info [cpaneld] 196.206.106.111 - lepopuli "GET /login/?login_only=1&user=lepopuli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopuli (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.211.4.39
country_id: 2510769
description:
[2026-06-26 23:13:14 +0000] info [cpaneld] 77.211.4.39 - lepo "GET /login/?login_only=1&user=lepo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.207.193.190
country_id: 290557
description:
[2026-06-26 23:13:17 +0000] info [cpaneld] 94.207.193.190 - lep "GET /login/?login_only=1&user=lep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.180.11
country_id: 1562822
description:
[2026-06-26 23:13:20 +0000] info [cpaneld] 14.191.180.11 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.94.229.179
country_id: 3437598
description:
[2026-06-26 23:14:36 +0000] info [cpaneld] 181.94.229.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.85.128.210
country_id: 3469034
description:
[2026-06-26 23:14:45 +0000] info [cpaneld] 187.85.128.210 - ucaouuttg "GET /login/?login_only=1&user=ucaouuttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouuttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.107.160.142
country_id: 3469034
description:
[2026-06-26 23:15:04 +0000] info [cpaneld] 190.107.160.142 - uc "GET /login/?login_only=1&user=uc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.65.254
country_id: 3895114
description:
[2026-06-26 23:14:49 +0000] info [cpaneld] 179.60.65.254 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.19.253.80
country_id: 3469034
description:
[2026-06-26 23:14:52 +0000] info [cpaneld] 187.19.253.80 - ucaou "GET /login/?login_only=1&user=ucaou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.228.135.246
country_id: 1210997
description:
[2026-06-26 23:14:56 +0000] info [cpaneld] 150.228.135.246 - ucao "GET /login/?login_only=1&user=ucao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.43.106.212
country_id: 3932488
description:
[2026-06-26 23:14:41 +0000] info [cpaneld] 190.43.106.212 - atm "GET /login/?login_only=1&user=atm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.191.147
country_id: 3469034
description:
[2026-06-26 23:15:00 +0000] info [cpaneld] 170.81.191.147 - uca "GET /login/?login_only=1&user=uca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.137.238.103
country_id: 2750405
description:
[2026-06-26 23:15:09 +0000] info [cpaneld] 188.137.238.103 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.11.181
country_id: 99237
description:
[2026-06-26 23:14:35 +0000] info [cpaneld] 169.224.11.181 - atmstg "GET /login/?login_only=1&user=atmstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atmstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.10.102.157
country_id: 2635167
description:
[2026-06-26 23:14:39 +0000] info [cpaneld] 82.10.102.157 - ucaouut "GET /login/?login_only=1&user=ucaouut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 26 23:15:12 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.242.54.143
country_id: 3996063
description:
[2026-06-26 23:14:27 +0000] info [cpaneld] 177.242.54.143 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.20.104.62
country_id: 1605651
description:
[2026-06-26 23:14:32 +0000] info [cpaneld] 1.20.104.62 - atms "GET /login/?login_only=1&user=atms&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atms (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.147.220.96
country_id: 3686110
description:
[2026-06-26 23:15:38 +0000] info [cpaneld] 186.147.220.96 - wa "GET /login/?login_only=1&user=wa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.211.199.53
country_id: 3469034
description:
[2026-06-26 23:15:19 +0000] info [cpaneld] 186.211.199.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.67.204
country_id: 2921044
description:
[2026-06-26 23:15:21 +0000] info [cpaneld] 92.208.67.204 - wages "GET /login/?login_only=1&user=wages&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wages (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.253.112.167
country_id: 3469034
description:
[2026-06-26 23:15:28 +0000] info [cpaneld] 191.253.112.167 - wage "GET /login/?login_only=1&user=wage&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wage (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.198.235
country_id: 1512440
description:
[2026-06-26 23:15:33 +0000] info [cpaneld] 144.124.198.235 - wag "GET /login/?login_only=1&user=wag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.109.103
country_id: 99237
description:
[2026-06-26 23:17:05 +0000] info [cpaneld] 185.181.109.103 - kfauto "GET /login/?login_only=1&user=kfauto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfauto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.235.155.3
country_id: 2464461
description:
[2026-06-26 23:17:13 +0000] info [cpaneld] 196.235.155.3 - kfaut "GET /login/?login_only=1&user=kfaut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfaut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.125.246.132
country_id: 3469034
description:
[2026-06-26 23:17:10 +0000] info [cpaneld] 179.125.246.132 - kfautotg "GET /login/?login_only=1&user=kfautotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfautotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.205.199.146
country_id: 174982
description:
[2026-06-26 23:17:02 +0000] info [cpaneld] 91.205.199.146 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.181.74.133
country_id: 1210997
description:
[2026-06-26 23:17:25 +0000] info [cpaneld] 103.181.74.133 - kf "GET /login/?login_only=1&user=kf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.55.17.209
country_id: 6252001
description:
[2026-06-26 23:17:25 +0000] info [whostmgrd] 143.55.17.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.74.106.61
country_id: 3469034
description:
[2026-06-26 23:17:17 +0000] info [cpaneld] 177.74.106.61 - kfau "GET /login/?login_only=1&user=kfau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.139.191.198
country_id: 3996063
description:
[2026-06-26 23:17:21 +0000] info [cpaneld] 189.139.191.198 - kfa "GET /login/?login_only=1&user=kfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfa (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.80.62.52
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2025/12/a358e04b-5067-49fb-9ead-1810a3282f30-300x220.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.137.238.103
country_id: 2750405
description:
[2026-06-26 23:18:15 +0000] info [cpaneld] 188.137.238.103 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.165.38.234
country_id: 2017370
description:
[2026-06-26 23:19:35 +0000] info [cpaneld] 5.165.38.234 - matosshop "GET /login/?login_only=1&user=matosshop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matosshop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.187.129.188
country_id: 1168579
description:
[2026-06-26 23:19:38 +0000] info [cpaneld] 182.187.129.188 - matosshoptg "GET /login/?login_only=1&user=matosshoptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matosshoptg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.173.230.241
country_id: 298795
description:
[2026-06-26 23:19:41 +0000] info [cpaneld] 95.173.230.241 - matossho "GET /login/?login_only=1&user=matossho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matossho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.188.219.42
country_id: 3895114
description:
[2026-06-26 23:19:44 +0000] info [cpaneld] 201.188.219.42 - matossh "GET /login/?login_only=1&user=matossh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matossh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.64.201.253
country_id: 294640
description:
[2026-06-26 23:19:49 +0000] info [cpaneld] 85.64.201.253 - matos "GET /login/?login_only=1&user=matos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.63.72.80
country_id: 3865483
description:
[2026-06-26 23:19:31 +0000] info [cpaneld] 179.63.72.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.53.50.80
country_id: 3508796
description:
[2026-06-26 23:19:47 +0000] info [cpaneld] 206.53.50.80 - matoss "GET /login/?login_only=1&user=matoss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matoss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.102.76.118
country_id: 3469034
description:
[2026-06-26 23:19:57 +0000] info [cpaneld] 149.102.76.118 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.36.9.32
country_id: 2017370
description:
[2026-06-26 23:20:02 +0000] info [cpaneld] 92.36.9.32 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.240.230.61
country_id: 2589581
description:
[2026-06-26 23:20:40 +0000] info [cpaneld] 154.240.230.61 - mondeai "GET /login/?login_only=1&user=mondeai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mondeai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.37.239
country_id: 1733045
description:
[2026-06-26 23:20:44 +0000] info [cpaneld] 115.164.37.239 - mondeaitg "GET /login/?login_only=1&user=mondeaitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mondeaitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.225.87.161
country_id: 3469034
description:
[2026-06-26 23:20:50 +0000] info [cpaneld] 45.225.87.161 - monde "GET /login/?login_only=1&user=monde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monde (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.193.99.200
country_id: 3996063
description:
[2026-06-26 23:20:52 +0000] info [cpaneld] 187.193.99.200 - mond "GET /login/?login_only=1&user=mond&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mond (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.164.152.126
country_id: 290557
description:
[2026-06-26 23:20:58 +0000] info [cpaneld] 217.164.152.126 - mo "GET /login/?login_only=1&user=mo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.51.88.124
country_id: 3686110
description:
[2026-06-26 23:21:05 +0000] info [cpaneld] 181.51.88.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.25.229.29
country_id: 2017370
description:
[2026-06-26 23:20:47 +0000] info [cpaneld] 94.25.229.29 - mondea "GET /login/?login_only=1&user=mondea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mondea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.221.52
country_id: 2287781
description:
[2026-06-26 23:20:55 +0000] info [cpaneld] 102.209.221.52 - mon "GET /login/?login_only=1&user=mon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.133.26
country_id: 3895114
description:
[2026-06-26 23:20:38 +0000] info [cpaneld] 181.42.133.26 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.22.121.242
country_id: 953987
description:
[2026-06-26 23:21:26 +0000] info [cpaneld] 102.22.121.242 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.17.180.249
country_id: 2017370
description:
[2026-06-26 23:21:28 +0000] info [cpaneld] 178.17.180.249 - tcham "GET /login/?login_only=1&user=tcham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcham (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.69.154.59
country_id: 2661886
description:
[2026-06-26 23:21:31 +0000] info [cpaneld] 176.69.154.59 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.70.112.1
country_id: 289688
description:
[2026-06-26 23:21:15 +0000] info [cpaneld] 212.70.112.1 - tchambainv "GET /login/?login_only=1&user=tchambainv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.22.48.85
country_id: 783754
description:
[2026-06-26 23:21:18 +0000] info [cpaneld] 31.22.48.85 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.45.188
country_id: 3996063
description:
[2026-06-26 23:21:37 +0000] info [cpaneld] 189.203.45.188 - tc "GET /login/?login_only=1&user=tc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tc (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.160
country_id: 1880251
description:
43.173.181.160 - - [26/Jun/2026:23:22:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208971&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fniger-cnsp-cedeao%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782516122 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/niger-cnsp-cedeao/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.43.233.179
country_id: 3658394
description:
[2026-06-26 23:21:12 +0000] info [cpaneld] 186.43.233.179 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.108.197.66
country_id: 3144096
description:
[2026-06-26 23:21:20 +0000] info [cpaneld] 83.108.197.66 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.137.238.103
country_id: 2750405
description:
[2026-06-26 23:21:22 +0000] info [cpaneld] 188.137.238.103 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.115.165
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2019/09/AMI-PROJET-CENTRALE-KEP-REVU-EXPLOITATION-28-08-2019.pdf HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.53.214.252
country_id: 3658394
description:
[2026-06-26 23:21:34 +0000] info [cpaneld] 177.53.214.252 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.83.114.68
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6167.85 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.148.129.205
country_id: 2017370
description:
[2026-06-26 23:21:22 +0000] info [cpaneld] 46.148.129.205 - tchamba "GET /login/?login_only=1&user=tchamba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 26 23:22:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.188.52.54
country_id: 1643084
description:
2026-06-26 23:23:44 dovecot_plain authenticator failed for H=(localhost) [103.188.52.54]:64290: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.177.69
country_id: 3625428
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-content/uploads/2024/02/meilleur-prix-1.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [26/Jun/2026:23:24:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053023&pdata=http%253A%252F%252Fwebdisk.cinema.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782516277 HTTP/1.1" 302 0 webdisk.cinema.free.netmaster.tg "http://webdisk.cinema.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.28.117.132
country_id: 1880251
description:
119.28.117.132 - - [26/Jun/2026:23:24:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265308&pdata=http%253A%252F%252Ftogodailynews.tg%252Fecobank-tchad-rejoint-le-programme-trade-finance-de-proparco%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782516282 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.28.117.132


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.139.226.109
country_id: 192950
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-content/uploads/2024/02/livraison-24h-24.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.250.11.217
country_id: 3865483
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-content/uploads/2023/06/project_6_1.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.76.44.215
country_id: 2542007
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-content/uploads/2024/07/Image-illustrant-un-projet-un-navire-transportant-un-avion-par-exemple-ou-un-convoi-militaire-scaled.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [26/Jun/2026:23:24:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119575&pdata=http%253A%252F%252Fautodiscover.cinema.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782516280 HTTP/1.1" 302 0 autodiscover.cinema.free.netmaster.tg "http://autodiscover.cinema.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.132.178.47
country_id: 1210997
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/wp-content/uploads/2023/04/CERTE-LOGISTICS-LOGO_Plan-de-travail-1-copie.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.137.238.103
country_id: 2750405
description:
[2026-06-26 23:25:02 +0000] info [cpaneld] 188.137.238.103 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.15.58.176
country_id: 1282988
description:
[2026-06-26 23:27:00 +0000] info [cpaneld] 157.15.58.176 - speau "GET /login/?login_only=1&user=speau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user speau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.244.22.162
country_id: 2589581
description:
[2026-06-26 23:27:02 +0000] info [cpaneld] 154.244.22.162 - speautg "GET /login/?login_only=1&user=speautg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user speautg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.37.26
country_id: 3895114
description:
[2026-06-26 23:26:55 +0000] info [cpaneld] 181.43.37.26 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.235.124.53
country_id: 298795
description:
[2026-06-26 23:27:13 +0000] info [cpaneld] 176.235.124.53 - spe "GET /login/?login_only=1&user=spe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.31.38
country_id: 3996063
description:
[2026-06-26 23:27:16 +0000] info [cpaneld] 187.190.31.38 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.230.158.35
country_id: 2017370
description:
[2026-06-26 23:28:25 +0000] info [cpaneld] 37.230.158.35 - istmtg "GET /login/?login_only=1&user=istmtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istmtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.93.33.165
country_id: 1210997
description:
[2026-06-26 23:28:29 +0000] info [cpaneld] 103.93.33.165 - ist "GET /login/?login_only=1&user=ist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.132.6.109
country_id: 953987
description:
[2026-06-26 23:28:34 +0000] info [cpaneld] 41.132.6.109 - is "GET /login/?login_only=1&user=is&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user is (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.205.242.96
country_id: 2017370
description:
[2026-06-26 23:28:15 +0000] info [cpaneld] 178.205.242.96 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.154.126
country_id: 953987
description:
104.28.154.126 - - [26/Jun/2026:23:28:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134442&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D2090&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782516495 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=2090" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.154.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.174.77.121
country_id: 2017370
description:
[2026-06-26 23:28:19 +0000] info [cpaneld] 109.174.77.121 - istm "GET /login/?login_only=1&user=istm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.19.195
country_id: 3932488
description:
[2026-06-26 23:30:11 +0000] info [cpaneld] 179.6.19.195 - ccl "GET /login/?login_only=1&user=ccl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ccl (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.186
country_id: 3175395
description:
Jun 26 23:29:31 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.185.78.167
country_id: 3469034
description:
[2026-06-26 23:30:07 +0000] info [cpaneld] 191.185.78.167 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.97.163.28
country_id: 3617476
description:
[2026-06-26 23:30:35 +0000] info [cpaneld] 138.97.163.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.122.28
country_id: 99237
description:
[2026-06-26 23:30:46 +0000] info [cpaneld] 212.237.122.28 - auditeccan "GET /login/?login_only=1&user=auditeccan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.202.6
country_id: 3469034
description:
[2026-06-26 23:30:59 +0000] info [cpaneld] 45.232.202.6 - auditec "GET /login/?login_only=1&user=auditec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.18.178.200
country_id: 3469034
description:
[2026-06-26 23:31:03 +0000] info [cpaneld] 201.18.178.200 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.75.9
country_id: 3865483
description:
[2026-06-26 23:30:15 +0000] info [cpaneld] 190.105.75.9 - ccltg "GET /login/?login_only=1&user=ccltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ccltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.125.135.3
country_id: 2017370
description:
[2026-06-26 23:31:08 +0000] info [cpaneld] 176.125.135.3 - audi "GET /login/?login_only=1&user=audi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.245.141.141
country_id: 290557
description:
[2026-06-26 23:31:06 +0000] info [cpaneld] 37.245.141.141 - audit "GET /login/?login_only=1&user=audit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.109.98.228
country_id: 3469034
description:
[2026-06-26 23:31:12 +0000] info [cpaneld] 187.109.98.228 - aud "GET /login/?login_only=1&user=aud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.51.240.11
country_id: 6252001
description:
[2026-06-26 23:30:37 +0000] info [whostmgrd] 68.51.240.11 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.245.129
country_id: 1733045
description:
[2026-06-26 23:30:40 +0000] info [cpaneld] 27.125.245.129 - auditeccandco "GET /login/?login_only=1&user=auditeccandco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.7.254.163
country_id: 2017370
description:
[2026-06-26 23:30:44 +0000] info [cpaneld] 212.7.254.163 - auditeccandcocom "GET /login/?login_only=1&user=auditeccandcocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandcocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.137.238.103
country_id: 2750405
description:
[2026-06-26 23:30:48 +0000] info [cpaneld] 188.137.238.103 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.152.13.5
country_id: 3996063
description:
[2026-06-26 23:32:04 +0000] info [cpaneld] 189.152.13.5 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.251.95
country_id: 1605651
description:
[2026-06-26 23:31:35 +0000] info [cpaneld] 184.22.251.95 - caissede "GET /login/?login_only=1&user=caissede&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissede (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.238.149
country_id: 3996063
description:
[2026-06-26 23:31:38 +0000] info [cpaneld] 177.245.238.149 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.178.104.85
country_id: 3703430
description:
[2026-06-26 23:31:14 +0000] info [cpaneld] 181.178.104.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.39.98
country_id: 3865483
description:
[2026-06-26 23:31:18 +0000] info [cpaneld] 181.46.39.98 - au "GET /login/?login_only=1&user=au&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user au (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.45.83.251
country_id: 1522867
description:
[2026-06-26 23:32:07 +0000] info [cpaneld] 212.45.83.251 - lerendezvoustg "GET /login/?login_only=1&user=lerendezvoustg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerendezvoustg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.218.10.69
country_id: 2017370
description:
[2026-06-26 23:31:29 +0000] info [cpaneld] 185.218.10.69 - caisseder "GET /login/?login_only=1&user=caisseder&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisseder (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.66.254.108
country_id: 3469034
description:
[2026-06-26 23:31:43 +0000] info [cpaneld] 177.66.254.108 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.0.116.86
country_id: 3469034
description:
[2026-06-26 23:32:00 +0000] info [cpaneld] 143.0.116.86 - cai "GET /login/?login_only=1&user=cai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.146.96.104
country_id: 3996063
description:
[2026-06-26 23:32:03 +0000] info [cpaneld] 187.146.96.104 - lerendezvous "GET /login/?login_only=1&user=lerendezvous&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerendezvous (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.180.30.79
country_id: 3996063
description:
[2026-06-26 23:31:17 +0000] info [cpaneld] 189.180.30.79 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.14.233.201
country_id: 3469034
description:
[2026-06-26 23:31:21 +0000] info [cpaneld] 189.14.233.201 - caissederetraitestg "GET /login/?login_only=1&user=caissederetraitestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraitestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.170.163.44
country_id: 1562822
description:
[2026-06-26 23:31:55 +0000] info [cpaneld] 113.170.163.44 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.58.74.90
country_id: 6254930
description:
[2026-06-26 23:32:29 +0000] info [cpaneld] 194.58.74.90 - leren "GET /login/?login_only=1&user=leren&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leren (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.118.77.132
country_id: 1831722
description:
[2026-06-26 23:32:33 +0000] info [cpaneld] 45.118.77.132 - lere "GET /login/?login_only=1&user=lere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lere (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.146.172.224
country_id: 2542007
description:
[2026-06-26 23:32:20 +0000] info [cpaneld] 197.146.172.224 - lerendez "GET /login/?login_only=1&user=lerendez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerendez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.102.120.238
country_id: 3469034
description:
[2026-06-26 23:32:23 +0000] info [cpaneld] 187.102.120.238 - lerende "GET /login/?login_only=1&user=lerende&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerende (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.127.226.60
country_id: 2510769
description:
[2026-06-26 23:32:36 +0000] info [cpaneld] 86.127.226.60 - ler "GET /login/?login_only=1&user=ler&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ler (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.0.56.151
country_id: 3469034
description:
[2026-06-26 23:32:16 +0000] info [cpaneld] 170.0.56.151 - lerendezv "GET /login/?login_only=1&user=lerendezv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerendezv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.59.39
country_id: 1282988
description:
[2026-06-26 23:32:26 +0000] info [cpaneld] 111.119.59.39 - lerend "GET /login/?login_only=1&user=lerend&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lerend (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.60.161.10
country_id: 102358
description:
[2026-06-26 23:32:40 +0000] info [cpaneld] 50.60.161.10 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.33.207.217
country_id: 3469034
description:
[2026-06-26 23:33:33 +0000] info [cpaneld] 187.33.207.217 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.9.38.125
country_id: 3469034
description:
[2026-06-26 23:33:40 +0000] info [cpaneld] 177.9.38.125 - benatextg "GET /login/?login_only=1&user=benatextg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benatextg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.136.50
country_id: 3865483
description:
[2026-06-26 23:33:43 +0000] info [cpaneld] 181.117.136.50 - benate "GET /login/?login_only=1&user=benate&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benate (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.81.152.30
country_id: 3865483
description:
[2026-06-26 23:33:15 +0000] info [cpaneld] 200.81.152.30 - camegtogo "GET /login/?login_only=1&user=camegtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.180.14.189
country_id: 2921044
description:
[2026-06-26 23:33:36 +0000] info [cpaneld] 84.180.14.189 - benatex "GET /login/?login_only=1&user=benatex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benatex (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.73.63.115
country_id: 1168579
description:
[2026-06-26 23:33:22 +0000] info [cpaneld] 119.73.63.115 - camegtog "GET /login/?login_only=1&user=camegtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.239.155.240
country_id: 3996063
description:
[2026-06-26 23:33:30 +0000] info [cpaneld] 189.239.155.240 - camegt "GET /login/?login_only=1&user=camegt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.233.4.87
country_id: 298795
description:
[2026-06-26 23:33:32 +0000] info [cpaneld] 178.233.4.87 - cameg "GET /login/?login_only=1&user=cameg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cameg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.186.150.86
country_id: 3017382
description:
[2026-06-26 23:33:34 +0000] info [cpaneld] 176.186.150.86 - came "GET /login/?login_only=1&user=came&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user came (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.184.100.107
country_id: 1733045
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1760717045 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.73.195.31
country_id: 3469034
description:
[2026-06-26 23:33:40 +0000] info [cpaneld] 177.73.195.31 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.188.178.41
country_id: 3355338
description:
[2026-06-26 23:33:36 +0000] info [cpaneld] 197.188.178.41 - cam "GET /login/?login_only=1&user=cam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.181.69.17
country_id: 1210997
description:
[2026-06-26 23:33:47 +0000] info [cpaneld] 103.181.69.17 - benat "GET /login/?login_only=1&user=benat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.255.39.201
country_id: 3865483
description:
[2026-06-26 23:33:54 +0000] info [cpaneld] 143.255.39.201 - ben "GET /login/?login_only=1&user=ben&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ben (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.234.71.139
country_id: 298795
description:
[2026-06-26 23:33:57 +0000] info [cpaneld] 176.234.71.139 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.230.241.170
country_id: 2017370
description:
[2026-06-26 23:33:18 +0000] info [cpaneld] 185.230.241.170 - camegtogotg "GET /login/?login_only=1&user=camegtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.98.130
country_id: 3932488
description:
[2026-06-26 23:35:12 +0000] info [cpaneld] 38.25.98.130 - lagorainfo "GET /login/?login_only=1&user=lagorainfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.164.201
country_id: 6252001
description:
[2026-06-26 23:35:23 +0000] info [cpaneld] 172.56.164.201 - lagorain "GET /login/?login_only=1&user=lagorain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.82.119.164
country_id: 2245662
description:
[2026-06-26 23:35:39 +0000] info [cpaneld] 41.82.119.164 - lagor "GET /login/?login_only=1&user=lagor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.224.194.134
country_id: 3469034
description:
[2026-06-26 23:35:43 +0000] info [cpaneld] 38.224.194.134 - lago "GET /login/?login_only=1&user=lago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.125.4.51
country_id: 1327865
description:
[2026-06-26 23:35:17 +0000] info [cpaneld] 45.125.4.51 - lagorainfotg "GET /login/?login_only=1&user=lagorainfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainfotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.201.83.246
country_id: 3865483
description:
[2026-06-26 23:35:21 +0000] info [cpaneld] 128.201.83.246 - lagorainf "GET /login/?login_only=1&user=lagorainf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainf (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.136.175
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1724618620 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 71.71.240.73
country_id: 6252001
domain: relanceinfo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:qjzcsoob||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 71.71.240.73
country_id: 6252001
domain: relanceinfo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:qjzcsoob||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 80.7.251.176
country_id: 2635167
domain: relanceinfo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:qjzcsoob||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 80.7.251.176
country_id: 2635167
domain: relanceinfo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:qjzcsoob||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.101.62.155
country_id: 3508796
description:
[2026-06-26 23:38:02 +0000] info [cpaneld] 148.101.62.155 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.177.27.221
country_id: 3865483
description:
[2026-06-26 23:38:12 +0000] info [cpaneld] 181.177.27.221 - vit "GET /login/?login_only=1&user=vit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.78.191.143
country_id: 2017370
description:
[2026-06-26 23:37:53 +0000] info [cpaneld] 91.78.191.143 - vitrinenew "GET /login/?login_only=1&user=vitrinenew&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenew (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.222.248.105
country_id: 298795
description:
[2026-06-26 23:37:41 +0000] info [cpaneld] 131.222.248.105 - vitrinenews "GET /login/?login_only=1&user=vitrinenews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.230.252
country_id: 3865483
description:
[2026-06-26 23:37:47 +0000] info [cpaneld] 170.81.230.252 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.225.71.161
country_id: 3686110
description:
[2026-06-26 23:37:57 +0000] info [cpaneld] 181.225.71.161 - vitrinen "GET /login/?login_only=1&user=vitrinen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.42.22.1
country_id: 2017370
description:
[2026-06-26 23:38:08 +0000] info [cpaneld] 46.42.22.1 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.242.105.110
country_id: 2017370
description:
[2026-06-26 23:38:00 +0000] info [cpaneld] 193.242.105.110 - vitrine "GET /login/?login_only=1&user=vitrine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.92.105.162
country_id: 2542007
description:
[2026-06-26 23:38:05 +0000] info [cpaneld] 41.92.105.162 - vitri "GET /login/?login_only=1&user=vitri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.95.237.50
country_id: 2921044
description:
[2026-06-26 23:39:06 +0000] info [cpaneld] 46.95.237.50 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.148.177.103
country_id: 1210997
description:
[2026-06-26 23:38:16 +0000] info [cpaneld] 103.148.177.103 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.40.231
country_id: 1282988
description:
[2026-06-26 23:39:09 +0000] info [cpaneld] 103.190.40.231 - certlogisticstogo "GET /login/?login_only=1&user=certlogisticstogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.204.64.168
country_id: 290557
description:
[2026-06-26 23:39:37 +0000] info [cpaneld] 94.204.64.168 - certlo "GET /login/?login_only=1&user=certlo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.161.218.254
country_id: 3469034
description:
[2026-06-26 23:39:45 +0000] info [cpaneld] 131.161.218.254 - cert "GET /login/?login_only=1&user=cert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.37.142.255
country_id: 2017370
description:
[2026-06-26 23:39:48 +0000] info [cpaneld] 92.37.142.255 - cer "GET /login/?login_only=1&user=cer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.193.211.111
country_id: 3469034
description:
[2026-06-26 23:39:54 +0000] info [cpaneld] 186.193.211.111 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.210.173.166
country_id: 2921044
description:
[2026-06-26 23:39:16 +0000] info [cpaneld] 2.210.173.166 - certlogisticstogocom "GET /login/?login_only=1&user=certlogisticstogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.62.5
country_id: 3865483
description:
[2026-06-26 23:39:20 +0000] info [cpaneld] 138.84.62.5 - certlogist "GET /login/?login_only=1&user=certlogist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.108.77.125
country_id: 3686110
description:
[2026-06-26 23:39:28 +0000] info [cpaneld] 190.108.77.125 - certlogi "GET /login/?login_only=1&user=certlogi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.62.143.13
country_id: 3686110
description:
[2026-06-26 23:39:32 +0000] info [cpaneld] 206.62.143.13 - certlog "GET /login/?login_only=1&user=certlog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.172.251.73
country_id: 3895114
description:
[2026-06-26 23:40:28 +0000] info [cpaneld] 181.172.251.73 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.20.51.88
country_id: 3895114
description:
[2026-06-26 23:40:17 +0000] info [cpaneld] 190.20.51.88 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.225.160.48
country_id: 2510769
description:
[2026-06-26 23:40:22 +0000] info [cpaneld] 212.225.160.48 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.1.174.175
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 65.1.174.175: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 26 23:43:55 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.43.240.12
country_id: 2017370
description:
[2026-06-26 23:45:25 +0000] info [cpaneld] 188.43.240.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.82.207.230
country_id: 2245662
description:
[2026-06-26 23:46:05 +0000] info [cpaneld] 41.82.207.230 - fundacion "GET /login/?login_only=1&user=fundacion&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacion (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.96.25.114
country_id: 290557
description:
[2026-06-26 23:45:50 +0000] info [cpaneld] 92.96.25.114 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.69.57.0
country_id: 3686110
description:
[2026-06-26 23:46:03 +0000] info [cpaneld] 190.69.57.0 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.44.219.68
country_id: 3625428
description:
[2026-06-26 23:45:40 +0000] info [cpaneld] 200.44.219.68 - ese "GET /login/?login_only=1&user=ese&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.59.222
country_id: 290557
description:
[2026-06-26 23:46:03 +0000] info [cpaneld] 5.38.59.222 - fundacione "GET /login/?login_only=1&user=fundacione&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacione (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.24.95.98
country_id: 2017370
description:
[2026-06-26 23:46:12 +0000] info [cpaneld] 81.24.95.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.160.97.166
country_id: 3469034
description:
[2026-06-26 23:45:31 +0000] info [cpaneld] 45.160.97.166 - ese2itg "GET /login/?login_only=1&user=ese2itg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2itg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.221.229.239
country_id: 3996063
description:
[2026-06-26 23:45:35 +0000] info [cpaneld] 189.221.229.239 - sma "GET /login/?login_only=1&user=sma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.7.125.117
country_id: 3469034
description:
[2026-06-26 23:45:22 +0000] info [cpaneld] 189.7.125.117 - smarty "GET /login/?login_only=1&user=smarty&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smarty (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.196.43
country_id: 1512440
description:
[2026-06-26 23:45:29 +0000] info [cpaneld] 144.124.196.43 - smart "GET /login/?login_only=1&user=smart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smart (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.150.137.76
country_id: 2661886
description:
[2026-06-26 23:45:32 +0000] info [cpaneld] 188.150.137.76 - smar "GET /login/?login_only=1&user=smar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.111.16.220
country_id: 3686110
description:
[2026-06-26 23:45:43 +0000] info [cpaneld] 191.111.16.220 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.228.8.215
country_id: 1605651
description:
[2026-06-26 23:46:08 +0000] info [cpaneld] 49.228.8.215 - fundacio "GET /login/?login_only=1&user=fundacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.26.102
country_id: 3686110
description:
[2026-06-26 23:45:17 +0000] info [cpaneld] 181.63.26.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.66.218.168
country_id: 3469034
description:
[2026-06-26 23:45:36 +0000] info [cpaneld] 177.66.218.168 - ese2 "GET /login/?login_only=1&user=ese2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.113.101.95
country_id: 3624060
description:
[2026-06-26 23:45:38 +0000] info [cpaneld] 190.113.101.95 - sm "GET /login/?login_only=1&user=sm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.52.241.203
country_id: 3469034
description:
[2026-06-26 23:46:10 +0000] info [cpaneld] 177.52.241.203 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.203.32.18
country_id: 285570
description:
[2026-06-26 23:45:25 +0000] info [cpaneld] 89.203.32.18 - smartytg "GET /login/?login_only=1&user=smartytg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smartytg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.74.77
country_id: 1512440
description:
[2026-06-26 23:46:13 +0000] info [cpaneld] 213.230.74.77 - cfm "GET /login/?login_only=1&user=cfm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.38.127.55
country_id: 3469034
description:
[2026-06-26 23:46:34 +0000] info [cpaneld] 177.38.127.55 - mediato "GET /login/?login_only=1&user=mediato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.156.245.10
country_id: 3895114
description:
[2026-06-26 23:46:38 +0000] info [cpaneld] 186.156.245.10 - mediat "GET /login/?login_only=1&user=mediat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.150.182.72
country_id: 2661886
description:
[2026-06-26 23:46:42 +0000] info [cpaneld] 188.150.182.72 - media "GET /login/?login_only=1&user=media&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user media (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.212.190.151
country_id: 2287781
description:
[2026-06-26 23:46:47 +0000] info [cpaneld] 102.212.190.151 - soeurndetogocom "GET /login/?login_only=1&user=soeurndetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.106.127.170
country_id: 783754
description:
[2026-06-26 23:46:51 +0000] info [cpaneld] 79.106.127.170 - soeurndeto "GET /login/?login_only=1&user=soeurndeto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndeto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.255.122.99
country_id: 3469034
description:
[2026-06-26 23:46:31 +0000] info [cpaneld] 138.255.122.99 - mediatop "GET /login/?login_only=1&user=mediatop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.122.208
country_id: 99237
description:
[2026-06-26 23:46:37 +0000] info [cpaneld] 212.237.122.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.177.196.139
country_id: 2017370
description:
[2026-06-26 23:46:59 +0000] info [cpaneld] 178.177.196.139 - soeurnde "GET /login/?login_only=1&user=soeurnde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnde (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.131.111.134
country_id: 290291
description:
[2026-06-26 23:47:05 +0000] info [cpaneld] 37.131.111.134 - soeurn "GET /login/?login_only=1&user=soeurn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.244.106
country_id: 3686110
description:
[2026-06-26 23:47:09 +0000] info [cpaneld] 38.51.244.106 - soeur "GET /login/?login_only=1&user=soeur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.197.199
country_id: 3469034
description:
[2026-06-26 23:46:17 +0000] info [cpaneld] 45.232.197.199 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.72.91.62
country_id: 3469034
description:
[2026-06-26 23:46:18 +0000] info [cpaneld] 177.72.91.62 - fundac "GET /login/?login_only=1&user=fundac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.116.71.116
country_id: 6251999
description:
[2026-06-26 23:46:21 +0000] info [cpaneld] 142.116.71.116 - mediatopne "GET /login/?login_only=1&user=mediatopne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.207.165
country_id: 99237
description:
[2026-06-26 23:46:21 +0000] info [cpaneld] 185.187.207.165 - funda "GET /login/?login_only=1&user=funda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user funda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.235.33.164
country_id: 3469034
description:
[2026-06-26 23:46:24 +0000] info [cpaneld] 45.235.33.164 - mediatopn "GET /login/?login_only=1&user=mediatopn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.33.30
country_id: 3865483
description:
[2026-06-26 23:46:27 +0000] info [cpaneld] 186.158.33.30 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.129.214.74
country_id: 3017382
description:
[2026-06-26 23:46:44 +0000] info [cpaneld] 92.129.214.74 - medi "GET /login/?login_only=1&user=medi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user medi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.203.16.220
country_id: 290557
description:
[2026-06-26 23:46:18 +0000] info [cpaneld] 94.203.16.220 - mediatopnewstg "GET /login/?login_only=1&user=mediatopnewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.0.66.172
country_id: 3865483
description:
[2026-06-26 23:46:47 +0000] info [cpaneld] 143.0.66.172 - med "GET /login/?login_only=1&user=med&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user med (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.120.75
country_id: 3895114
description:
[2026-06-26 23:46:51 +0000] info [cpaneld] 181.43.120.75 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.230.99.86
country_id: 298795
description:
[2026-06-26 23:46:55 +0000] info [cpaneld] 88.230.99.86 - soeurndet "GET /login/?login_only=1&user=soeurndet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.97.174.194
country_id: 290557
description:
[2026-06-26 23:47:03 +0000] info [cpaneld] 92.97.174.194 - soeurnd "GET /login/?login_only=1&user=soeurnd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.101.46.1
country_id: 2589581
description:
[2026-06-26 23:46:23 +0000] info [cpaneld] 105.101.46.1 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.250.153.159
country_id: 3932488
description:
[2026-06-26 23:46:32 +0000] info [cpaneld] 38.250.153.159 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.153.253.186
country_id: 102358
description:
[2026-06-26 23:47:12 +0000] info [cpaneld] 46.153.253.186 - soeu "GET /login/?login_only=1&user=soeu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.92.207.109
country_id: 2542007
description:
[2026-06-26 23:47:18 +0000] info [cpaneld] 196.92.207.109 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.29.107.222
country_id: 3686110
description:
[2026-06-26 23:47:16 +0000] info [cpaneld] 186.29.107.222 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-26 23:48:07 +0000] info [cpaneld] 38.72.131.163 - healthca "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user healthca (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.212.222
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/bien-etre-yoto-nest-plus-un-petit-village-isole/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.44.114.17
country_id: 3895114
description:
[2026-06-26 23:48:32 +0000] info [cpaneld] 190.44.114.17 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.146.91.104
country_id: 3686110
description:
[2026-06-26 23:48:42 +0000] info [cpaneld] 186.146.91.104 - crechepeti "GET /login/?login_only=1&user=crechepeti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepeti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.120.76.65
country_id: 3895114
description:
[2026-06-26 23:48:47 +0000] info [cpaneld] 200.120.76.65 - letablo "GET /login/?login_only=1&user=letablo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letablo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.173.127.230
country_id: 2017370
description:
[2026-06-26 23:48:49 +0000] info [cpaneld] 85.173.127.230 - letabl "GET /login/?login_only=1&user=letabl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.19.120.224
country_id: 2017370
description:
[2026-06-26 23:48:48 +0000] info [cpaneld] 195.19.120.224 - crechepe "GET /login/?login_only=1&user=crechepe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.201.209
country_id: 2542007
description:
[2026-06-26 23:48:52 +0000] info [cpaneld] 105.77.201.209 - crechep "GET /login/?login_only=1&user=crechep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.99.91.142
country_id: 1643084
description:
[2026-06-26 23:48:53 +0000] info [cpaneld] 118.99.91.142 - letab "GET /login/?login_only=1&user=letab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letab (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.212.222
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bien-etre-yoto-nest-plus-un-petit-village-isole/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.200.218.29
country_id: 3686110
description:
[2026-06-26 23:48:36 +0000] info [cpaneld] 152.200.218.29 - letabloid "GET /login/?login_only=1&user=letabloid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.122.90.194
country_id: 3865483
description:
[2026-06-26 23:48:55 +0000] info [cpaneld] 186.122.90.194 - creche "GET /login/?login_only=1&user=creche&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user creche (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.97.54.239
country_id: 3469034
description:
[2026-06-26 23:48:59 +0000] info [cpaneld] 200.97.54.239 - leta "GET /login/?login_only=1&user=leta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.30.175.79
country_id: 3077311
description:
[2026-06-26 23:49:00 +0000] info [cpaneld] 31.30.175.79 - crec "GET /login/?login_only=1&user=crec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.136.7.204
country_id: 2802361
description:
[2026-06-26 23:48:45 +0000] info [cpaneld] 217.136.7.204 - crechepet "GET /login/?login_only=1&user=crechepet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.181.235.50
country_id: 3996063
description:
[2026-06-26 23:49:02 +0000] info [cpaneld] 189.181.235.50 - let "GET /login/?login_only=1&user=let&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user let (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.231.92
country_id: 1562822
description:
[2026-06-26 23:49:05 +0000] info [cpaneld] 14.191.231.92 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.183.107.251
country_id: 1562822
description:
[2026-06-26 23:48:43 +0000] info [cpaneld] 113.183.107.251 - letabloi "GET /login/?login_only=1&user=letabloi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.116.30.191
country_id: 6251999
description:
[2026-06-26 23:48:58 +0000] info [cpaneld] 142.116.30.191 - crech "GET /login/?login_only=1&user=crech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.78.96.2
country_id: 2017370
description:
[2026-06-26 23:49:02 +0000] info [cpaneld] 95.78.96.2 - cre "GET /login/?login_only=1&user=cre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.13.16
country_id: 3686110
description:
[2026-06-26 23:49:05 +0000] info [cpaneld] 181.78.13.16 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 91.102.14.195
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 91.102.14.195: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.82.65.93
country_id: 1819730
description:
Jun 26 23:50:29 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.82.65.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.65.93
country_id: 1819730
description:
2026-06-26 23:50:31 dovecot_plain authenticator failed for H=(ddp1salrmzz2t8o6i5fcvdm) [47.82.65.93]:54362: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.172.131.185
country_id: 3932488
description:
[2026-06-26 23:51:55 +0000] info [cpaneld] 38.172.131.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 149.202.66.130
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 149.202.66.130: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.80.227.32
country_id: 3469034
description:
[2026-06-26 23:53:55 +0000] info [cpaneld] 170.80.227.32 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.219.20.177
country_id: 298795
description:
[2026-06-26 23:53:58 +0000] info [cpaneld] 176.219.20.177 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.255.89.9
country_id: 99237
description:
[2026-06-26 23:54:12 +0000] info [cpaneld] 130.255.89.9 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.111.235
country_id: 1282988
description:
[2026-06-26 23:53:48 +0000] info [cpaneld] 27.34.111.235 - togofar "GET /login/?login_only=1&user=togofar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.234.94.216
country_id: 298795
description:
[2026-06-26 23:53:50 +0000] info [cpaneld] 176.234.94.216 - togofa "GET /login/?login_only=1&user=togofa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.163.63.89
country_id: 6252001
description:
[2026-06-26 23:53:38 +0000] info [cpaneld] 68.163.63.89 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 71.132.8.142
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.117
country_id: 3865483
description:
Jun 26 23:54:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.208.15.140
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1307366965 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.32.230.130
country_id: 3202326
description:
[2026-06-26 23:55:17 +0000] info [cpaneld] 86.32.230.130 - kpmgtg "GET /login/?login_only=1&user=kpmgtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpmgtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.48.30
country_id: 3658394
description:
[2026-06-26 23:55:59 +0000] info [cpaneld] 191.99.48.30 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.249.190.124
country_id: 3469034
description:
[2026-06-26 23:55:15 +0000] info [cpaneld] 167.249.190.124 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.70.91.10
country_id: 3865483
description:
[2026-06-26 23:55:20 +0000] info [cpaneld] 45.70.91.10 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.38.192.118
country_id: 3865483
description:
[2026-06-26 23:56:03 +0000] info [cpaneld] 179.38.192.118 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.57.49.64
country_id: 3865483
description:
[2026-06-26 23:56:05 +0000] info [cpaneld] 186.57.49.64 - togomedia2 "GET /login/?login_only=1&user=togomedia2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.130.62.5
country_id: 3996063
description:
[2026-06-26 23:55:25 +0000] info [cpaneld] 189.130.62.5 - kp "GET /login/?login_only=1&user=kp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.202.44.128
country_id: 3469034
description:
[2026-06-26 23:56:17 +0000] info [cpaneld] 143.202.44.128 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.191.148.189
country_id: 3469034
description:
[2026-06-26 23:56:20 +0000] info [cpaneld] 181.191.148.189 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.241.25.48
country_id: 2017370
description:
[2026-06-26 23:56:23 +0000] info [cpaneld] 92.241.25.48 - togome "GET /login/?login_only=1&user=togome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togome (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.223.113
country_id: 290291
description:
[2026-06-26 23:56:26 +0000] info [cpaneld] 77.69.223.113 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.105.171.219
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1592384963 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.251.234.37
country_id: 1562822
description:
[2026-06-26 23:56:31 +0000] info [cpaneld] 171.251.234.37 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.2.122.209
country_id: 3469034
description:
[2026-06-26 23:56:36 +0000] info [cpaneld] 187.2.122.209 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.5.252.138
country_id: 2921044
description:
[2026-06-26 23:56:39 +0000] info [cpaneld] 37.5.252.138 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.119.231
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.119.231: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.157.190.93
country_id: 1327865
description:
[2026-06-26 23:57:42 +0000] info [cpaneld] 202.157.190.93 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.173.12.173
country_id: 1562822
description:
[2026-06-26 23:57:48 +0000] info [cpaneld] 14.173.12.173 - belal "GET /login/?login_only=1&user=belal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.56.106.245
country_id: 1522867
description:
[2026-06-26 23:57:39 +0000] info [cpaneld] 95.56.106.245 - belali "GET /login/?login_only=1&user=belali&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belali (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.78.122.226
country_id: 2017370
description:
[2026-06-26 23:57:53 +0000] info [cpaneld] 91.78.122.226 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.74.128
country_id: 3658394
description:
[2026-06-26 23:57:57 +0000] info [cpaneld] 191.99.74.128 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.26.66
country_id: 3686110
description:
[2026-06-27 00:00:08 +0000] info [cpaneld] 181.63.26.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.176.248.221
country_id: 2921044
description:
[2026-06-26 23:59:28 +0000] info [cpaneld] 94.176.248.221 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.136.168.200
country_id: 3996063
description:
[2026-06-26 23:59:31 +0000] info [cpaneld] 187.136.168.200 - cecap "GET /login/?login_only=1&user=cecap&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecap (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.141.21.142
country_id: 3996063
description:
[2026-06-26 23:59:39 +0000] info [cpaneld] 201.141.21.142 - ceca "GET /login/?login_only=1&user=ceca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.235.91.100
country_id: 3996063
description:
[2026-06-26 23:59:41 +0000] info [cpaneld] 187.235.91.100 - cec "GET /login/?login_only=1&user=cec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.121.249
country_id: 3658394
description:
[2026-06-27 00:00:24 +0000] info [cpaneld] 157.100.121.249 - banml "GET /login/?login_only=1&user=banml&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banml (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.74.59.135
country_id: 3469034
description:
[2026-06-27 00:00:35 +0000] info [cpaneld] 187.74.59.135 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.139.225.160
country_id: 2017370
description:
[2026-06-27 00:00:19 +0000] info [cpaneld] 5.139.225.160 - banmlabtg "GET /login/?login_only=1&user=banmlabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.108.44
country_id: 3895114
description:
[2026-06-27 00:00:29 +0000] info [cpaneld] 186.189.108.44 - banm "GET /login/?login_only=1&user=banm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.239.195.72
country_id: 1562822
description:
[2026-06-27 00:00:32 +0000] info [cpaneld] 171.239.195.72 - ban "GET /login/?login_only=1&user=ban&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ban (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.41.202
country_id: 3658394
description:
[2026-06-27 00:00:16 +0000] info [cpaneld] 157.100.41.202 - banmlab "GET /login/?login_only=1&user=banmlab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.154.21.226
country_id: 102358
description:
[2026-06-27 00:00:22 +0000] info [cpaneld] 142.154.21.226 - banmla "GET /login/?login_only=1&user=banmla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmla (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.129
country_id: 1880251
description:
47.128.121.129 - - [27/Jun/2026:00:01:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235271&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Frapport-gestion-des-fonds-covid-19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782518484 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/rapport-gestion-des-fonds-covid-19/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-27 00:01:46 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:37816: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.86.96.48
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/486528242 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.84.81.248
country_id: 3686110
description:
[2026-06-27 00:03:27 +0000] info [cpaneld] 206.84.81.248 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.30.61
country_id: 1733045
description:
[2026-06-27 00:03:37 +0000] info [cpaneld] 60.50.30.61 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.207.27.88
country_id: 2017370
description:
[2026-06-27 00:04:12 +0000] info [cpaneld] 91.207.27.88 - zontalomem "GET /login/?login_only=1&user=zontalomem&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.122.67
country_id: 99237
description:
[2026-06-27 00:04:09 +0000] info [cpaneld] 212.237.122.67 - zontalomemilleniumtg "GET /login/?login_only=1&user=zontalomemilleniumtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemilleniumtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.250.167.198
country_id: 2017370
description:
[2026-06-27 00:03:33 +0000] info [cpaneld] 89.250.167.198 - aria "GET /login/?login_only=1&user=aria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aria (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.189.195.81
country_id: 3469034
description:
[2026-06-27 00:04:06 +0000] info [cpaneld] 177.189.195.81 - zontalomemillenium "GET /login/?login_only=1&user=zontalomemillenium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemillenium (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.242.105.52
country_id: 2017370
description:
[2026-06-27 00:03:25 +0000] info [cpaneld] 193.242.105.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.196.27.193
country_id: 2264397
description:
[2026-06-27 00:03:31 +0000] info [cpaneld] 87.196.27.193 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.93.194.130
country_id: 3469034
description:
[2026-06-27 00:04:03 +0000] info [cpaneld] 201.93.194.130 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.253.215.146
country_id: 1210997
description:
[2026-06-27 00:04:44 +0000] info [cpaneld] 123.253.215.146 - zon "GET /login/?login_only=1&user=zon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.253.245.97
country_id: 102358
description:
[2026-06-27 00:04:16 +0000] info [cpaneld] 51.253.245.97 - zontalome "GET /login/?login_only=1&user=zontalome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalome (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.35.121.207
country_id: 3469034
description:
[2026-06-27 00:04:27 +0000] info [cpaneld] 189.35.121.207 - zontalo "GET /login/?login_only=1&user=zontalo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.13.96.246
country_id: 3865483
description:
[2026-06-27 00:04:35 +0000] info [cpaneld] 186.13.96.246 - zonta "GET /login/?login_only=1&user=zonta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zonta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.191.136.145
country_id: 1694008
description:
[2026-06-27 00:04:39 +0000] info [cpaneld] 180.191.136.145 - zont "GET /login/?login_only=1&user=zont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.194.150.130
country_id: 3658394
description:
[2026-06-27 00:04:23 +0000] info [cpaneld] 168.194.150.130 - zontalom "GET /login/?login_only=1&user=zontalom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.225.177.169
country_id: 3469034
description:
[2026-06-27 00:04:30 +0000] info [cpaneld] 45.225.177.169 - zontal "GET /login/?login_only=1&user=zontal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.171.233.208
country_id: 2921044
description:
[2026-06-27 00:04:46 +0000] info [cpaneld] 80.171.233.208 - zo "GET /login/?login_only=1&user=zo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.49
country_id: 6252001
description:
205.169.39.49 - - [27/Jun/2026:00:06:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923684&pdata=http%253A%252F%252Fdavakconsulting.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782518764 HTTP/1.1" 302 0 davakconsulting.com "http://davakconsulting.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 27 00:05:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.181.207
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:107.172.181.207||TA:107.172.181.207||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 47.82.213.231
country_id: 1880251
domain: www.arse.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/147.0.7727.15 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.217.137
country_id: 2750405
domain: soena.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:expirefreenetmas||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.45.74.163
country_id: 3895114
description:
[2026-06-27 00:09:11 +0000] info [cpaneld] 190.45.74.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.137.231
country_id: 3865483
description:
[2026-06-27 00:09:24 +0000] info [cpaneld] 143.105.137.231 - cloudandra "GET /login/?login_only=1&user=cloudandra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudandra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.254
country_id: 3895114
description:
[2026-06-27 00:09:33 +0000] info [cpaneld] 179.60.74.254 - cloudand "GET /login/?login_only=1&user=cloudand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.60.225
country_id: 290557
description:
[2026-06-27 00:09:39 +0000] info [cpaneld] 5.38.60.225 - clouda "GET /login/?login_only=1&user=clouda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clouda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.183.69.241
country_id: 3469034
description:
[2026-06-27 00:09:48 +0000] info [cpaneld] 45.183.69.241 - clo "GET /login/?login_only=1&user=clo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.157.94.49
country_id: 1210997
description:
[2026-06-27 00:09:17 +0000] info [cpaneld] 103.157.94.49 - cloudandracks "GET /login/?login_only=1&user=cloudandracks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User cloudandracks has their account suspended. Login blocked.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.240
country_id: 1880251
description:
43.173.176.240 - - [27/Jun/2026:00:09:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001305&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Ftogo-la-conference-sur-lentrepreneuriat-social-accouchera-une-proposition-de-projets-de-loi-en-faveur-des-entreprises-sociales-et-rse%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782518957 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Ftogo-la-conference-sur-lentrepreneuriat-social-accouchera-une-proposition-de-projets-de-loi-en-faveur-des-entreprises-sociales-et-rse%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.240


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.248.172.239
country_id: 2017370
description:
[2026-06-27 00:09:35 +0000] info [cpaneld] 109.248.172.239 - cloudan "GET /login/?login_only=1&user=cloudan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.96.72
country_id: 2017370
description:
[2026-06-27 00:09:41 +0000] info [cpaneld] 77.222.96.72 - cloud "GET /login/?login_only=1&user=cloud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.21.156.72
country_id: 3865483
description:
[2026-06-27 00:09:44 +0000] info [cpaneld] 181.21.156.72 - clou "GET /login/?login_only=1&user=clou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.169.234.246
country_id: 2017370
description:
[2026-06-27 00:09:50 +0000] info [cpaneld] 136.169.234.246 - cl "GET /login/?login_only=1&user=cl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.136.38.65
country_id: 690791
description:
[2026-06-27 00:09:19 +0000] info [cpaneld] 178.136.38.65 - cloudandrackstg "GET /login/?login_only=1&user=cloudandrackstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudandrackstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.138.124.112
country_id: 6252001
description:
[2026-06-27 00:10:25 +0000] info [whostmgrd] 76.138.124.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.38
country_id: 3469034
description:
Jun 27 00:14:01 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.249.5
country_id: 3469034
description:
Jun 27 00:13:51 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.249.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.75.99.198
country_id: 2542007
description:
[2026-06-27 00:16:10 +0000] info [cpaneld] 196.75.99.198 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.211.4.168
country_id: 2510769
description:
[2026-06-27 00:17:03 +0000] info [cpaneld] 77.211.4.168 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.143.102
country_id: 294640
description:
[2026-06-27 00:17:05 +0000] info [cpaneld] 79.177.143.102 - lcttogo "GET /login/?login_only=1&user=lcttogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcttogo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [27/Jun/2026:00:17:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803205&pdata=http%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782519423 HTTP/1.1" 302 0 ruralinfos.tg "http://ruralinfos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.162.110.72
country_id: 3469034
description:
[2026-06-27 00:16:30 +0000] info [cpaneld] 201.162.110.72 - nstream "GET /login/?login_only=1&user=nstream&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.226.5
country_id: 3996063
description:
[2026-06-27 00:16:35 +0000] info [cpaneld] 177.245.226.5 - nstrea "GET /login/?login_only=1&user=nstrea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstrea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.188.240.96
country_id: 3625428
description:
[2026-06-27 00:16:39 +0000] info [cpaneld] 38.188.240.96 - nstre "GET /login/?login_only=1&user=nstre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.222.22
country_id: 3469034
description:
[2026-06-27 00:16:52 +0000] info [cpaneld] 45.165.222.22 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.164.18.147
country_id: 3895114
description:
[2026-06-27 00:17:09 +0000] info [cpaneld] 190.164.18.147 - lcttogotg "GET /login/?login_only=1&user=lcttogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcttogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.229.148.235
country_id: 6251999
description:
[2026-06-27 00:16:25 +0000] info [cpaneld] 99.229.148.235 - nstreamp "GET /login/?login_only=1&user=nstreamp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.171.145
country_id: 3923057
description:
[2026-06-27 00:16:50 +0000] info [cpaneld] 181.115.171.145 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.217.196.210
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2020/01/Bnen-300x300.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.236.58.138
country_id: 1562822
description:
[2026-06-27 00:18:02 +0000] info [cpaneld] 171.236.58.138 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.5.249.206
country_id: 3469034
description:
[2026-06-27 00:17:13 +0000] info [cpaneld] 45.5.249.206 - lcttog "GET /login/?login_only=1&user=lcttog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcttog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.195.19.41
country_id: 6252001
description:
[2026-06-27 00:17:26 +0000] info [whostmgrd] 71.195.19.41 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.27.121.76
country_id: 2017370
description:
[2026-06-27 00:17:25 +0000] info [cpaneld] 95.27.121.76 - lc "GET /login/?login_only=1&user=lc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.55.24.143
country_id: 6252001
description:
[2026-06-27 00:17:28 +0000] info [whostmgrd] 104.55.24.143 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.10.159.23
country_id: 6252001
description:
[2026-06-27 00:17:39 +0000] info [whostmgrd] 71.10.159.23 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.170.222.90
country_id: 99237
description:
[2026-06-27 00:17:46 +0000] info [cpaneld] 95.170.222.90 - davetec "GET /login/?login_only=1&user=davetec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.69.208.220
country_id: 953987
description:
[2026-06-27 00:17:49 +0000] info [cpaneld] 102.69.208.220 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.252.31.130
country_id: 1210997
description:
[2026-06-27 00:17:17 +0000] info [cpaneld] 138.252.31.130 - lctto "GET /login/?login_only=1&user=lctto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lctto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.130.110.165
country_id: 6251999
description:
[2026-06-27 00:17:29 +0000] info [cpaneld] 66.130.110.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.189.128.85
country_id: 6252001
description:
[2026-06-27 00:17:31 +0000] info [whostmgrd] 73.189.128.85 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.19.18.11
country_id: 2186224
description:
[2026-06-27 00:17:53 +0000] info [cpaneld] 149.19.18.11 - davet "GET /login/?login_only=1&user=davet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.239.244
country_id: 99237
description:
[2026-06-27 00:17:59 +0000] info [cpaneld] 62.201.239.244 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.223.50.13
country_id: 2017370
description:
[2026-06-27 00:19:10 +0000] info [cpaneld] 89.223.50.13 - libertet "GET /login/?login_only=1&user=libertet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.238.179
country_id: 3865483
description:
[2026-06-27 00:18:53 +0000] info [cpaneld] 186.158.238.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.158.252.235
country_id: 2921044
description:
[2026-06-27 00:19:00 +0000] info [cpaneld] 62.158.252.235 - libertetogotg "GET /login/?login_only=1&user=libertetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.63.16
country_id: 1694008
description:
[2026-06-27 00:19:04 +0000] info [cpaneld] 136.158.63.16 - libertetog "GET /login/?login_only=1&user=libertetog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.47.148
country_id: 285570
description:
[2026-06-27 00:19:07 +0000] info [cpaneld] 37.231.47.148 - liberteto "GET /login/?login_only=1&user=liberteto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liberteto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.27.136.181
country_id: 2017370
description:
[2026-06-27 00:19:30 +0000] info [cpaneld] 95.27.136.181 - li "GET /login/?login_only=1&user=li&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user li (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.44.91.203
country_id: 3469034
description:
[2026-06-27 00:19:12 +0000] info [cpaneld] 187.44.91.203 - liberte "GET /login/?login_only=1&user=liberte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liberte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.247.120.88
country_id: 3686110
description:
[2026-06-27 00:19:20 +0000] info [cpaneld] 77.247.120.88 - liber "GET /login/?login_only=1&user=liber&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liber (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.251.14.83
country_id: 3469034
description:
[2026-06-27 00:19:27 +0000] info [cpaneld] 186.251.14.83 - lib "GET /login/?login_only=1&user=lib&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lib (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.120.91.115
country_id: 2017370
description:
[2026-06-27 00:20:37 +0000] info [cpaneld] 79.120.91.115 - univer "GET /login/?login_only=1&user=univer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.225.204.241
country_id: 3469034
description:
[2026-06-27 00:20:55 +0000] info [cpaneld] 179.225.204.241 - un "GET /login/?login_only=1&user=un&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user un (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [27/Jun/2026:00:20:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658201&pdata=http%253A%252F%252Fcpcontacts.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782519653 HTTP/1.1" 302 0 cpcontacts.api.free.netmaster.tg "http://cpcontacts.api.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.100
country_id: 3895114
description:
[2026-06-27 00:20:16 +0000] info [cpaneld] 179.60.74.100 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.148.85.204
country_id: 102358
description:
[2026-06-27 00:20:29 +0000] info [cpaneld] 169.148.85.204 - universco "GET /login/?login_only=1&user=universco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.151.54
country_id: 3469034
description:
[2026-06-27 00:20:46 +0000] info [cpaneld] 45.190.151.54 - univ "GET /login/?login_only=1&user=univ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.237.56
country_id: 3469034
description:
[2026-06-27 00:20:22 +0000] info [cpaneld] 191.242.237.56 - universcom "GET /login/?login_only=1&user=universcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.177.133.159
country_id: 290557
description:
[2026-06-27 00:20:26 +0000] info [cpaneld] 109.177.133.159 - universcomtg "GET /login/?login_only=1&user=universcomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.43.250.244
country_id: 3658394
description:
[2026-06-27 00:20:35 +0000] info [cpaneld] 186.43.250.244 - univers "GET /login/?login_only=1&user=univers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.172.6.216
country_id: 3865483
description:
[2026-06-27 00:20:42 +0000] info [cpaneld] 190.172.6.216 - unive "GET /login/?login_only=1&user=unive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user unive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.248.253.164
country_id: 2017370
description:
[2026-06-27 00:20:31 +0000] info [cpaneld] 109.248.253.164 - universc "GET /login/?login_only=1&user=universc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universc (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.6.64
country_id: 6252001
domain: mail.express.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.express.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.18.39.86
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/fao/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.18.39.86
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/tag/fao/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.11.19.61
country_id: 3469034
description:
[2026-06-27 00:24:02 +0000] info [cpaneld] 177.11.19.61 - ortouche "GET /login/?login_only=1&user=ortouche&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouche (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.136.140.169
country_id: 1733045
description:
[2026-06-27 00:24:09 +0000] info [cpaneld] 175.136.140.169 - ortouchecom "GET /login/?login_only=1&user=ortouchecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouchecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.181.81
country_id: 3865483
description:
[2026-06-27 00:25:11 +0000] info [cpaneld] 186.128.181.81 - hapluc "GET /login/?login_only=1&user=hapluc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapluc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.203.42
country_id: 3686110
description:
[2026-06-27 00:24:20 +0000] info [cpaneld] 129.222.203.42 - ortou "GET /login/?login_only=1&user=ortou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.90.208.190
country_id: 3469034
description:
[2026-06-27 00:24:51 +0000] info [cpaneld] 189.90.208.190 - hapluciatogo "GET /login/?login_only=1&user=hapluciatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapluciatogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.167.142.234
country_id: 3469034
description:
[2026-06-27 00:24:34 +0000] info [cpaneld] 45.167.142.234 - or "GET /login/?login_only=1&user=or&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user or (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.53.146.136
country_id: 2077456
description:
[2026-06-27 00:25:04 +0000] info [cpaneld] 163.53.146.136 - haplucia "GET /login/?login_only=1&user=haplucia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user haplucia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.175.245.44
country_id: 1210997
description:
[2026-06-27 00:24:48 +0000] info [cpaneld] 103.175.245.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.172.90.106
country_id: 2510769
description:
[2026-06-27 00:24:54 +0000] info [cpaneld] 81.172.90.106 - hapluciatogotg "GET /login/?login_only=1&user=hapluciatogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapluciatogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.176.113.3
country_id: 2464461
description:
[2026-06-27 00:24:55 +0000] info [cpaneld] 196.176.113.3 - hapluciato "GET /login/?login_only=1&user=hapluciato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapluciato (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.217.137
country_id: 2750405
domain: cfmi.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:afdim||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.217.137
country_id: 2750405
domain: app.cfmi.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.28.217.137||TA:104.28.217.137||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.250.164.142
country_id: 1562822
description:
[2026-06-27 00:25:16 +0000] info [cpaneld] 171.250.164.142 - haplu "GET /login/?login_only=1&user=haplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user haplu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.174.204.163
country_id: 2017370
description:
[2026-06-27 00:25:23 +0000] info [cpaneld] 85.174.204.163 - ha "GET /login/?login_only=1&user=ha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.67.192.251
country_id: 3017382
description:
[2026-06-27 00:25:18 +0000] info [cpaneld] 37.67.192.251 - hapl "GET /login/?login_only=1&user=hapl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hapl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.45.10.27
country_id: 3469034
description:
[2026-06-27 00:27:35 +0000] info [cpaneld] 177.45.10.27 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.174.200.26
country_id: 298795
description:
[2026-06-27 00:27:50 +0000] info [cpaneld] 78.174.200.26 - educplus "GET /login/?login_only=1&user=educplus&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.178.73.103
country_id: 3703430
description:
[2026-06-27 00:27:53 +0000] info [cpaneld] 181.178.73.103 - educplu "GET /login/?login_only=1&user=educplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.78.219
country_id: 1512440
description:
[2026-06-27 00:27:58 +0000] info [cpaneld] 213.230.78.219 - educp "GET /login/?login_only=1&user=educp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.34.22
country_id: 1643084
description:
[2026-06-27 00:28:01 +0000] info [cpaneld] 182.9.34.22 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.135.40.118
country_id: 2017370
description:
[2026-06-27 00:28:09 +0000] info [cpaneld] 31.135.40.118 - ed "GET /login/?login_only=1&user=ed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ed (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.237.90.175
country_id: 192950
description:
197.237.90.175 - - [27/Jun/2026:00:27:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671830&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-190819tetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782520064 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-190819tetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.237.90.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.126
country_id: 3865483
description:
Jun 27 00:29:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.101.234
country_id: 1819730
description:
2026-06-27 00:29:19 dovecot_login authenticator failed for H=(47.82.101.234) [47.82.101.234]:51376: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.168.160.165
country_id: 3996063
description:
[2026-06-27 00:30:57 +0000] info [cpaneld] 187.168.160.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.88.18.141
country_id: 2017370
description:
[2026-06-27 00:31:07 +0000] info [cpaneld] 213.88.18.141 - lepointactutg "GET /login/?login_only=1&user=lepointactutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointactutg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.200.81
country_id: 6252001
description:
[2026-06-27 00:31:11 +0000] info [cpaneld] 47.150.200.81 - lepointact "GET /login/?login_only=1&user=lepointact&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointact (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.116.243.157
country_id: 660013
description:
[2026-06-27 00:31:14 +0000] info [cpaneld] 82.116.243.157 - lepointac "GET /login/?login_only=1&user=lepointac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.50.63.235
country_id: 3469034
description:
[2026-06-27 00:31:17 +0000] info [cpaneld] 189.50.63.235 - lepointa "GET /login/?login_only=1&user=lepointa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepointa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.21.50
country_id: 3469034
description:
[2026-06-27 00:31:22 +0000] info [cpaneld] 45.165.21.50 - lepoint "GET /login/?login_only=1&user=lepoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.22.52.245
country_id: 2017370
description:
[2026-06-27 00:31:27 +0000] info [cpaneld] 89.22.52.245 - lepoi "GET /login/?login_only=1&user=lepoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.245.19.49
country_id: 3469034
description:
[2026-06-27 00:31:31 +0000] info [cpaneld] 170.245.19.49 - lepo "GET /login/?login_only=1&user=lepo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.99.5
country_id: 1733045
description:
[2026-06-27 00:32:54 +0000] info [cpaneld] 113.211.99.5 - am "GET /login/?login_only=1&user=am&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user am (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.23.39.236
country_id: 1562822
description:
[2026-06-27 00:33:06 +0000] info [cpaneld] 123.23.39.236 - cciatv "GET /login/?login_only=1&user=cciatv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cciatv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.74.197.30
country_id: 2186224
description:
[2026-06-27 00:33:10 +0000] info [cpaneld] 121.74.197.30 - cciatvtg "GET /login/?login_only=1&user=cciatvtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cciatvtg (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.106.216.229
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:23.106.216.229||TA:23.106.216.229||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.32.73.254
country_id: 1522867
description:
[2026-06-27 00:32:36 +0000] info [cpaneld] 37.32.73.254 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.190.183.87
country_id: 3017382
description:
[2026-06-27 00:32:37 +0000] info [cpaneld] 88.190.183.87 - ameak "GET /login/?login_only=1&user=ameak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameak (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.62.52.46
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/feuille-de-route-gouvernementale-2021-premiere-demonstration-de-force/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.65.72
country_id: 3469034
description:
[2026-06-27 00:32:49 +0000] info [cpaneld] 177.124.65.72 - ame "GET /login/?login_only=1&user=ame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ame (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.208.29.200
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/feuille-de-route-gouvernementale-2021-premiere-demonstration-de-force/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.189.49.252
country_id: 2017370
description:
[2026-06-27 00:32:44 +0000] info [cpaneld] 90.189.49.252 - amea "GET /login/?login_only=1&user=amea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.143.147.254
country_id: 2017370
description:
[2026-06-27 00:33:02 +0000] info [cpaneld] 85.143.147.254 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.247.177.39
country_id: 1562822
description:
[2026-06-27 00:32:40 +0000] info [cpaneld] 14.247.177.39 - ameakco "GET /login/?login_only=1&user=ameakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameakco (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.165.0.252
country_id: 6252001
description:
104.165.0.252 - - [27/Jun/2026:00:32:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251878&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ffaure-gnassingbe-au-pied-du-mur%252Fedito%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782520369 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/faure-gnassingbe-au-pied-du-mur/edito/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9325.1732 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.165.0.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.107.242.234
country_id: 2017370
description:
[2026-06-27 00:33:14 +0000] info [cpaneld] 185.107.242.234 - cciat "GET /login/?login_only=1&user=cciat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cciat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.225.232
country_id: 1643084
description:
[2026-06-27 00:33:22 +0000] info [cpaneld] 182.10.225.232 - cci "GET /login/?login_only=1&user=cci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.122.249.15
country_id: 2017370
description:
[2026-06-27 00:33:16 +0000] info [cpaneld] 195.122.249.15 - ccia "GET /login/?login_only=1&user=ccia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ccia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.104.97.89
country_id: 3895114
description:
[2026-06-27 00:33:25 +0000] info [cpaneld] 186.104.97.89 - cc "GET /login/?login_only=1&user=cc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.224.86.52
country_id: 3658394
description:
[2026-06-27 00:34:56 +0000] info [cpaneld] 38.224.86.52 - direct7 "GET /login/?login_only=1&user=direct7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7 (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.161.116.7
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1778521415 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.110.79.241
country_id: 3686110
description:
[2026-06-27 00:34:52 +0000] info [cpaneld] 191.110.79.241 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.1.187.108
country_id: 3625428
description:
[2026-06-27 00:34:59 +0000] info [cpaneld] 206.1.187.108 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.234.86.18
country_id: 298795
description:
[2026-06-27 00:35:05 +0000] info [cpaneld] 88.234.86.18 - direc "GET /login/?login_only=1&user=direc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.42.26.30
country_id: 3175395
description:
[2026-06-27 00:35:13 +0000] info [cpaneld] 93.42.26.30 - dir "GET /login/?login_only=1&user=dir&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dir (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 27 00:34:13 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.112.53
country_id: 1512440
description:
[2026-06-27 00:35:02 +0000] info [cpaneld] 213.230.112.53 - direct "GET /login/?login_only=1&user=direct&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.2.126.44
country_id: 1694008
description:
[2026-06-27 00:35:10 +0000] info [cpaneld] 122.2.126.44 - dire "GET /login/?login_only=1&user=dire&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dire (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 122.107.128.64
country_id: 2077456
description:
122.107.128.64 - - [27/Jun/2026:00:35:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608089&pdata=https%253A%252F%252Fwebmail.inh.free.netmaster.tg%252F%253Flocale%253Dzh&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782520503 HTTP/2.0" 302 0 webmail.inh.free.netmaster.tg "https://webmail.inh.free.netmaster.tg/?locale=zh" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:122.107.128.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.87.61
country_id: 1512440
description:
[2026-06-27 00:35:17 +0000] info [cpaneld] 213.230.87.61 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.227.106.237
country_id: 2464461
description:
[2026-06-27 00:35:56 +0000] info [cpaneld] 41.227.106.237 - rolle "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.97.43
country_id: 2510769
domain: www.butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:DdWiN@CZ4v58.www.butodra.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.82
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/223841843 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.120.157
country_id: 3865483
description:
[2026-06-27 00:39:48 +0000] info [cpaneld] 186.158.120.157 - mfto "GET /login/?login_only=1&user=mfto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mfto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.118.148.108
country_id: 1562822
description:
[2026-06-27 00:39:32 +0000] info [cpaneld] 42.118.148.108 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.211.241.139
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1121604699 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.91.150.24
country_id: 3469034
description:
[2026-06-27 00:39:38 +0000] info [cpaneld] 177.91.150.24 - mftogo "GET /login/?login_only=1&user=mftogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.33.36.217
country_id: 6252001
description:
[2026-06-27 00:39:46 +0000] info [whostmgrd] 100.33.36.217 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.139
country_id: 1512440
description:
2026-06-27 00:40:44 H=([213.230.92.139]) [213.230.92.139]:12109 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.211.251.86
country_id: 289688
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/a1cfc1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 159.224.231.12
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/10/IMG-20191001-WA0069.jpg 1008w, http:/togodailynews.tg/wp-content/uploads/2019/10/IMG-20191001-WA0069-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2019/10/IMG-20191001-WA0069-768x576.jpg 768w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.120.181.219
country_id: 783754
description:
[2026-06-27 00:42:44 +0000] info [cpaneld] 185.120.181.219 - lcrade "GET /login/?login_only=1&user=lcrade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcrade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.90.109
country_id: 3996063
description:
[2026-06-27 00:42:55 +0000] info [cpaneld] 189.203.90.109 - lcr "GET /login/?login_only=1&user=lcr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.74.85
country_id: 1512440
description:
[2026-06-27 00:42:59 +0000] info [cpaneld] 213.230.74.85 - p2p2rstogotg "GET /login/?login_only=1&user=p2p2rstogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2rstogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.173.19
country_id: 3865483
description:
[2026-06-27 00:43:07 +0000] info [cpaneld] 181.20.173.19 - p2p2rsto "GET /login/?login_only=1&user=p2p2rsto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2rsto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.170.83.63
country_id: 2017370
description:
[2026-06-27 00:43:11 +0000] info [cpaneld] 188.170.83.63 - p2p2rst "GET /login/?login_only=1&user=p2p2rst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2rst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.20.144.146
country_id: 1643084
description:
[2026-06-27 00:42:42 +0000] info [cpaneld] 157.20.144.146 - lcrademorg "GET /login/?login_only=1&user=lcrademorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcrademorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.170.198.47
country_id: 2017370
description:
[2026-06-27 00:42:50 +0000] info [cpaneld] 195.170.198.47 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.205.241.160
country_id: 3469034
description:
[2026-06-27 00:42:37 +0000] info [cpaneld] 168.205.241.160 - lcradem "GET /login/?login_only=1&user=lcradem&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcradem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.45.227
country_id: 3895114
description:
[2026-06-27 00:42:52 +0000] info [cpaneld] 190.114.45.227 - lcra "GET /login/?login_only=1&user=lcra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lcra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.190.158
country_id: 3865483
description:
[2026-06-27 00:42:54 +0000] info [cpaneld] 45.228.190.158 - p2p2rstogo "GET /login/?login_only=1&user=p2p2rstogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2rstogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.150.30
country_id: 3658394
description:
[2026-06-27 00:43:21 +0000] info [cpaneld] 201.182.150.30 - p2p2 "GET /login/?login_only=1&user=p2p2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2 (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.170.30.30
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1816711992 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.219.19
country_id: 294640
description:
[2026-06-27 00:44:10 +0000] info [cpaneld] 147.235.219.19 - cenitogotg "GET /login/?login_only=1&user=cenitogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.55.23.243
country_id: 3686110
description:
[2026-06-27 00:43:28 +0000] info [cpaneld] 181.55.23.243 - p2 "GET /login/?login_only=1&user=p2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.41.41.25
country_id: 3625428
description:
[2026-06-27 00:44:02 +0000] info [cpaneld] 38.41.41.25 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.123.44
country_id: 3865483
description:
[2026-06-27 00:44:06 +0000] info [cpaneld] 190.105.123.44 - cenitogo "GET /login/?login_only=1&user=cenitogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.228.113.27
country_id: 6251999
description:
[2026-06-27 00:44:12 +0000] info [cpaneld] 99.228.113.27 - cenitog "GET /login/?login_only=1&user=cenitog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.34.151.182
country_id: 2017370
description:
[2026-06-27 00:43:16 +0000] info [cpaneld] 178.34.151.182 - p2p2r "GET /login/?login_only=1&user=p2p2r&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p2r (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.199.19
country_id: 3658394
description:
[2026-06-27 00:43:24 +0000] info [cpaneld] 157.100.199.19 - p2p "GET /login/?login_only=1&user=p2p&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user p2p (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.162.97.5
country_id: 690791
description:
Jun 27 00:44:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.162.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.162.97.5
country_id: 690791
description:
2026-06-27 00:44:25 dovecot_login authenticator failed for H=([218.52.113.36]) [81.162.97.5]:51936: 535 Incorrect authentication data (set_id=dev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.93.52
country_id: 3658394
description:
[2026-06-27 00:44:24 +0000] info [cpaneld] 148.227.93.52 - cenit "GET /login/?login_only=1&user=cenit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.227.74.52
country_id: 3469034
description:
[2026-06-27 00:44:32 +0000] info [cpaneld] 186.227.74.52 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.73.137.252
country_id: 953987
description:
Jun 27 00:44:53 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.73.137.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.135
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.333710916310888.php||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.242.175.120
country_id: 1643084
description:
[2026-06-27 00:44:18 +0000] info [cpaneld] 180.242.175.120 - cenito "GET /login/?login_only=1&user=cenito&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenito (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-27 00:44:37 +0000] info [cpaneld] 5.230.153.46 NEW cinemafreenetmas:jmOTOWc5a8tHaeN9 address=5.230.153.46,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.143.154
country_id: 2017370
description:
[2026-06-27 00:45:10 +0000] info [cpaneld] 95.26.143.154 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.245.149.208
country_id: 3865483
description:
[2026-06-27 00:45:25 +0000] info [cpaneld] 190.245.149.208 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.167.99.121
country_id: 298795
description:
[2026-06-27 00:45:28 +0000] info [cpaneld] 78.167.99.121 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.140.107
country_id: 2017370
description:
[2026-06-27 00:45:39 +0000] info [cpaneld] 95.25.140.107 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.236
country_id: 953987
description:
Jun 27 00:45:13 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.168.242.28
country_id: 6252001
description:
[2026-06-27 00:45:33 +0000] info [whostmgrd] 73.168.242.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.174.68.241
country_id: 1282988
description:
[2026-06-27 00:45:44 +0000] info [cpaneld] 103.174.68.241 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.100.207.94
country_id: 3469034
description:
[2026-06-27 00:45:33 +0000] info [cpaneld] 131.100.207.94 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.49.175.2
country_id: 3469034
description:
[2026-06-27 00:45:51 +0000] info [cpaneld] 179.49.175.2 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.242.183.17
country_id: 2017370
description:
[2026-06-27 00:45:13 +0000] info [cpaneld] 188.242.183.17 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.223.190.133
country_id: 1522867
description:
[2026-06-27 00:45:47 +0000] info [cpaneld] 185.223.190.133 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.215.60.13
country_id: 2017370
description:
[2026-06-27 00:47:11 +0000] info [cpaneld] 185.215.60.13 - snc "GET /login/?login_only=1&user=snc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.157.93.222
country_id: 1210997
description:
[2026-06-27 00:46:30 +0000] info [cpaneld] 103.157.93.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.96.165.250
country_id: 102358
description:
[2026-06-27 00:46:36 +0000] info [cpaneld] 94.96.165.250 - tontonedouardtogocom "GET /login/?login_only=1&user=tontonedouardtogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedouardtogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.193.115
country_id: 3658394
description:
[2026-06-27 00:46:56 +0000] info [cpaneld] 177.234.193.115 - tonto "GET /login/?login_only=1&user=tonto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tonto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.145.16
country_id: 294640
description:
[2026-06-27 00:47:06 +0000] info [cpaneld] 79.177.145.16 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.94.177.187
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1692861378 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.26.207
country_id: 2017370
description:
[2026-06-27 00:46:45 +0000] info [cpaneld] 109.252.26.207 - tontoned "GET /login/?login_only=1&user=tontoned&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontoned (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.158.250.12
country_id: 2017370
description:
[2026-06-27 00:46:47 +0000] info [cpaneld] 46.158.250.12 - tontone "GET /login/?login_only=1&user=tontone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.192.123.126
country_id: 1168579
description:
[2026-06-27 00:47:03 +0000] info [cpaneld] 154.192.123.126 - ton "GET /login/?login_only=1&user=ton&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ton (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.113.63.106
country_id: 2661886
description:
[2026-06-27 00:46:39 +0000] info [cpaneld] 213.113.63.106 - tontonedou "GET /login/?login_only=1&user=tontonedou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.9.72.211
country_id: 6252001
description:
[2026-06-27 00:46:41 +0000] info [cpaneld] 70.9.72.211 - tontonedo "GET /login/?login_only=1&user=tontonedo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tontonedo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.244.16
country_id: 1282988
description:
[2026-06-27 00:47:00 +0000] info [cpaneld] 103.225.244.16 - sncom "GET /login/?login_only=1&user=sncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.156
country_id: 3895114
description:
[2026-06-27 00:47:09 +0000] info [cpaneld] 179.60.66.156 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.190.22.248
country_id: 1562822
description:
[2026-06-27 00:47:15 +0000] info [cpaneld] 113.190.22.248 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.64.4
country_id: 3469034
description:
[2026-06-27 00:47:27 +0000] info [cpaneld] 131.0.64.4 - lesnidsurbains "GET /login/?login_only=1&user=lesnidsurbains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.70.44.117
country_id: 3658394
description:
[2026-06-27 00:47:42 +0000] info [cpaneld] 186.70.44.117 - lesnids "GET /login/?login_only=1&user=lesnids&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnids (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.138.121.157
country_id: 1733045
description:
[2026-06-27 00:47:56 +0000] info [cpaneld] 175.138.121.157 - lesn "GET /login/?login_only=1&user=lesn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.116.142.200
country_id: 294640
description:
[2026-06-27 00:47:30 +0000] info [cpaneld] 46.116.142.200 - lesnidsurbainstg "GET /login/?login_only=1&user=lesnidsurbainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbainstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.146.113.158
country_id: 587116
description:
[2026-06-27 00:47:58 +0000] info [cpaneld] 185.146.113.158 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.95.43.247
country_id: 3469034
description:
[2026-06-27 00:47:21 +0000] info [cpaneld] 177.95.43.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.199.93.203
country_id: 3017382
description:
[2026-06-27 00:47:49 +0000] info [cpaneld] 83.199.93.203 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 177.234.138.118
country_id: 1269750
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:177.234.138.118||TA:177.234.138.118||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.244.16
country_id: 1282988
description:
[2026-06-27 00:47:39 +0000] info [cpaneld] 103.225.244.16 - lesnidsu "GET /login/?login_only=1&user=lesnidsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsu (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 194.26.192.29
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 194.26.192.29: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.176.128
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1409949059 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.205.132
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.205.132
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.80.24.145
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/83a4ac HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.170.67.71
country_id: 3469034
description:
[2026-06-27 00:49:29 +0000] info [cpaneld] 45.170.67.71 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.163.251
country_id: 3865483
description:
[2026-06-27 00:49:33 +0000] info [cpaneld] 181.117.163.251 - nps "GET /login/?login_only=1&user=nps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nps (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.84.47.175
country_id: 3469034
description:
[2026-06-27 00:49:41 +0000] info [cpaneld] 177.84.47.175 - np "GET /login/?login_only=1&user=np&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user np (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.143.190.134
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1623213194 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.137.73.217
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1854752928 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.67.126.251
country_id: 1835841
description:
[2026-06-27 00:54:01 +0000] info [cpaneld] 180.67.126.251 - uc "GET /login/?login_only=1&user=uc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.255.132.21
country_id: 2017370
description:
[2026-06-27 00:53:59 +0000] info [cpaneld] 92.255.132.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.184.123.17
country_id: 2017370
description:
[2026-06-27 00:54:10 +0000] info [cpaneld] 109.184.123.17 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.238.75.109
country_id: 3932488
description:
[2026-06-27 00:54:11 +0000] info [cpaneld] 190.238.75.109 - dkfo "GET /login/?login_only=1&user=dkfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.209.108.23
country_id: 1210997
description:
[2026-06-27 00:53:37 +0000] info [cpaneld] 103.209.108.23 - ucoangerstg "GET /login/?login_only=1&user=ucoangerstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangerstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.24.146.153
country_id: 3658394
description:
[2026-06-27 00:53:50 +0000] info [cpaneld] 200.24.146.153 - ucoan "GET /login/?login_only=1&user=ucoan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.120.55
country_id: 3658394
description:
[2026-06-27 00:54:02 +0000] info [cpaneld] 157.100.120.55 - dkfood "GET /login/?login_only=1&user=dkfood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfood (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.159.30.107
country_id: 2542007
description:
[2026-06-27 00:53:32 +0000] info [cpaneld] 105.159.30.107 - ucoangers "GET /login/?login_only=1&user=ucoangers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.114.173.44
country_id: 3017382
description:
[2026-06-27 00:53:54 +0000] info [cpaneld] 83.114.173.44 - ucoa "GET /login/?login_only=1&user=ucoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.33.201.73
country_id: 3686110
description:
[2026-06-27 00:54:06 +0000] info [cpaneld] 179.33.201.73 - dkfoodtg "GET /login/?login_only=1&user=dkfoodtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfoodtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.123.233
country_id: 99237
description:
[2026-06-27 00:53:47 +0000] info [cpaneld] 212.237.123.233 - ucoang "GET /login/?login_only=1&user=ucoang&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoang (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.11.170
country_id: 1694008
description:
[2026-06-27 00:53:58 +0000] info [cpaneld] 136.158.11.170 - uco "GET /login/?login_only=1&user=uco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.89.42.48
country_id: 102358
description:
[2026-06-27 00:54:16 +0000] info [cpaneld] 2.89.42.48 - dkf "GET /login/?login_only=1&user=dkf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.110.59.177
country_id: 3658394
description:
[2026-06-27 00:54:19 +0000] info [cpaneld] 190.110.59.177 - dk "GET /login/?login_only=1&user=dk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.12.170.25
country_id: 3895114
description:
[2026-06-27 00:54:21 +0000] info [cpaneld] 190.12.170.25 - aname "GET /login/?login_only=1&user=aname&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aname (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.61.3.95
country_id: 2017370
description:
[2026-06-27 00:54:27 +0000] info [cpaneld] 46.61.3.95 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.85.67
country_id: 1733045
description:
[2026-06-27 00:54:24 +0000] info [cpaneld] 115.135.85.67 - anam "GET /login/?login_only=1&user=anam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anam (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 49.51.50.147
country_id: 6252001
domain: www.ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sanlam.com||User:egjvuiox||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.223.55
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1783465241 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.153.123.3
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1847||QS:add-to-cart=1847||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.216.98.113
country_id: 6252001
description:
[2026-06-27 00:57:15 +0000] info [whostmgrd] 217.216.98.113 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.193.245.156
country_id: 99237
description:
[2026-06-27 00:59:57 +0000] info [cpaneld] 130.193.245.156 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.89.67.2
country_id: 2017370
description:
[2026-06-27 01:00:09 +0000] info [cpaneld] 81.89.67.2 - yanac "GET /login/?login_only=1&user=yanac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yanac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.110.193
country_id: 3469034
description:
[2026-06-27 01:00:04 +0000] info [cpaneld] 153.67.110.193 - yanacomtg "GET /login/?login_only=1&user=yanacomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yanacomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.166.145.74
country_id: 3508796
description:
[2026-06-27 01:00:06 +0000] info [cpaneld] 190.166.145.74 - yanaco "GET /login/?login_only=1&user=yanaco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yanaco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.226.62.134
country_id: 3469034
description:
[2026-06-27 01:00:55 +0000] info [cpaneld] 45.226.62.134 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.27.136.47
country_id: 3625428
description:
[2026-06-27 01:00:45 +0000] info [cpaneld] 154.27.136.47 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.205.24.242
country_id: 290557
description:
[2026-06-27 01:00:12 +0000] info [cpaneld] 94.205.24.242 - yana "GET /login/?login_only=1&user=yana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.37.188.26
country_id: 3865483
description:
[2026-06-27 01:00:18 +0000] info [cpaneld] 179.37.188.26 - ya "GET /login/?login_only=1&user=ya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.209.196.16
country_id: 6252001
description:
[2026-06-27 01:00:49 +0000] info [whostmgrd] 47.209.196.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.42.137.232
country_id: 1814991
description:
101.42.137.232 - - [27/Jun/2026:01:00:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181767&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-covid-19-12-nouveaux-cas-positifs-enregistres-ce-jeudi-13-aout%252Fembed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782522048 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-covid-19-12-nouveaux-cas-positifs-enregistres-ce-jeudi-13-aout/embed/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.42.137.232


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.147.22.231
country_id: 6252001
description:
198.147.22.231 - - [27/Jun/2026:01:01:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816425&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782522115 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.147.22.231


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.88.36.172
country_id: 1880251
description:
[2026-06-27 01:03:11 +0000] info [cpaneld] 116.88.36.172 - las "GET /login/?login_only=1&user=las&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user las (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.183.2.106
country_id: 3469034
description:
[2026-06-27 01:03:04 +0000] info [cpaneld] 191.183.2.106 - sotraneto "GET /login/?login_only=1&user=sotraneto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotraneto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.95.70
country_id: 99237
description:
[2026-06-27 01:03:07 +0000] info [cpaneld] 169.224.95.70 - sotranet "GET /login/?login_only=1&user=sotranet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.89.140.111
country_id: 2542007
description:
[2026-06-27 01:03:06 +0000] info [cpaneld] 196.89.140.111 - lasn "GET /login/?login_only=1&user=lasn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.196.50
country_id: 3923057
description:
[2026-06-27 01:02:59 +0000] info [cpaneld] 131.0.196.50 - lasnb "GET /login/?login_only=1&user=lasnb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.72.162
country_id: 3996063
description:
[2026-06-27 01:02:59 +0000] info [cpaneld] 177.245.72.162 - sotranetog "GET /login/?login_only=1&user=sotranetog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetog (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.9.212.253
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1955182794 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.113.33
country_id: 3469034
description:
[2026-06-27 01:02:57 +0000] info [cpaneld] 191.5.113.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 45.144.37.22
country_id: 2017370
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.50.154.108
country_id: 2017370
description:
[2026-06-27 01:02:52 +0000] info [cpaneld] 94.50.154.108 - sotranetogo "GET /login/?login_only=1&user=sotranetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.30.245.108
country_id: 690791
description:
[2026-06-27 01:02:56 +0000] info [cpaneld] 78.30.245.108 - sotranetogocom "GET /login/?login_only=1&user=sotranetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.163.148.155
country_id: 3469034
description:
[2026-06-27 01:03:15 +0000] info [cpaneld] 164.163.148.155 - sotran "GET /login/?login_only=1&user=sotran&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotran (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.43.222
country_id: 1562822
description:
[2026-06-27 01:03:16 +0000] info [cpaneld] 14.191.43.222 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.179.17.186
country_id: 102358
description:
[2026-06-27 01:03:23 +0000] info [cpaneld] 141.179.17.186 - sot "GET /login/?login_only=1&user=sot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sot (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 27 01:04:05 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.74.199.78
country_id: 2017370
description:
[2026-06-27 01:03:18 +0000] info [cpaneld] 212.74.199.78 - sotra "GET /login/?login_only=1&user=sotra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.48.164.60
country_id: 3469034
description:
[2026-06-27 01:03:27 +0000] info [cpaneld] 179.48.164.60 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 27 01:04:31 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-27 01:08:59 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-27 01:09:00 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.57.176.81
country_id: 3865483
description:
[2026-06-27 01:09:09 +0000] info [cpaneld] 186.57.176.81 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.59.47.55
country_id: 6252001
description:
[2026-06-27 01:10:09 +0000] info [whostmgrd] 184.59.47.55 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.110.207.198
country_id: 3469034
description:
[2026-06-27 01:09:12 +0000] info [cpaneld] 200.110.207.198 - togofeedtg "GET /login/?login_only=1&user=togofeedtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeedtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.189.41.20
country_id: 3469034
description:
[2026-06-27 01:09:33 +0000] info [cpaneld] 179.189.41.20 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.228.64.106
country_id: 1605651
description:
[2026-06-27 01:09:38 +0000] info [cpaneld] 49.228.64.106 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-27 01:09:58 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-27 01:09:59 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 220.245.17.192
country_id: 2077456
description:
[2026-06-27 01:09:18 +0000] info [cpaneld] 220.245.17.192 - togofee "GET /login/?login_only=1&user=togofee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.197.201.219
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025-768x480.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.50.138.246
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1615913505 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.111.132.105
country_id: 6252001
description:
[2026-06-27 01:10:18 +0000] info [whostmgrd] 70.111.132.105 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.221.145
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/8beb68fcdbf9b0e9c01ba146dbbddb40_L.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.171.40.121
country_id: 6252001
description:
[2026-06-27 01:10:14 +0000] info [whostmgrd] 206.171.40.121 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.148.92.76
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/861243925 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.84.71.166
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Photo-3-768x511.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.59.220.69
country_id: 6252001
description:
[2026-06-27 01:12:32 +0000] info [whostmgrd] 173.59.220.69 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.8.140.3
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/617537216 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.161.50.108
country_id: 2017370
description:
46.161.50.108 - - [27/Jun/2026:01:12:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050597&pdata=https%253A%252F%252Flibertetogo.tg%252F6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782522748 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/6" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.161.50.108


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.10.156.15
country_id: 1643084
description:
2026-06-27 01:14:18 dovecot_plain authenticator failed for H=(localhost) [114.10.156.15]:64156: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.216
country_id: 3469034
description:
Jun 27 01:15:54 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.209.204.32
country_id: 6252001
description:
[2026-06-27 01:18:10 +0000] info [cpaneld] 73.209.204.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.60.129.77
country_id: 3865483
description:
[2026-06-27 01:18:24 +0000] info [cpaneld] 186.60.129.77 - sthandling "GET /login/?login_only=1&user=sthandling&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sthandling (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.33.66.155
country_id: 3469034
description:
[2026-06-27 01:18:27 +0000] info [cpaneld] 189.33.66.155 - sthandlin "GET /login/?login_only=1&user=sthandlin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sthandlin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.59.105
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/325918193 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.171.5
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/628378218 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.111.98.111
country_id: 1643084
description:
[2026-06-27 01:18:53 +0000] info [cpaneld] 103.111.98.111 - st "GET /login/?login_only=1&user=st&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user st (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.121.56.234
country_id: 1733045
description:
[2026-06-27 01:19:11 +0000] info [cpaneld] 121.121.56.234 - dagltg "GET /login/?login_only=1&user=dagltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.99.160
country_id: 3932488
description:
[2026-06-27 01:18:19 +0000] info [cpaneld] 38.25.99.160 - sthandlingaerotg "GET /login/?login_only=1&user=sthandlingaerotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sthandlingaerotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.152.199.127
country_id: 2464461
description:
[2026-06-27 01:18:34 +0000] info [cpaneld] 102.152.199.127 - sthandl "GET /login/?login_only=1&user=sthandl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sthandl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.50.116.114
country_id: 6251999
description:
[2026-06-27 01:18:48 +0000] info [cpaneld] 70.50.116.114 - sth "GET /login/?login_only=1&user=sth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sth (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.146.249
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/332185285 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.244.164
country_id: 99237
description:
[2026-06-27 01:18:45 +0000] info [cpaneld] 62.201.244.164 - stha "GET /login/?login_only=1&user=stha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.254.26
country_id: 6252001
description:
[2026-06-27 01:19:17 +0000] info [cpaneld] 73.170.254.26 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.28.156.41
country_id: 6252001
description:
[2026-06-27 01:20:02 +0000] info [whostmgrd] 23.28.156.41 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.71.37.135
country_id: 3658394
description:
[2026-06-27 01:19:14 +0000] info [cpaneld] 45.71.37.135 - dag "GET /login/?login_only=1&user=dag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dag (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 27 01:21:06 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.165.132
country_id: 6252001
description:
2026-06-27 01:21:23 dovecot_plain authenticator failed for H=(mail.tps.tg) [104.28.165.132]:26041: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.234.216.82
country_id: 3686110
description:
[2026-06-27 01:22:34 +0000] info [cpaneld] 181.234.216.82 - wellcitytg "GET /login/?login_only=1&user=wellcitytg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcitytg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.112.175
country_id: 6252001
description:
[2026-06-27 01:22:43 +0000] info [cpaneld] 76.33.112.175 - wellc "GET /login/?login_only=1&user=wellc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.76.169.67
country_id: 2542007
description:
[2026-06-27 01:22:46 +0000] info [cpaneld] 105.76.169.67 - well "GET /login/?login_only=1&user=well&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user well (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.22.110.6
country_id: 3895114
description:
[2026-06-27 01:22:50 +0000] info [cpaneld] 190.22.110.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.104.243.18
country_id: 2464461
description:
[2026-06-27 01:22:52 +0000] info [cpaneld] 102.104.243.18 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.45.239.9
country_id: 3865483
description:
[2026-06-27 01:23:04 +0000] info [cpaneld] 181.45.239.9 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.254.82.29
country_id: 3469034
description:
[2026-06-27 01:23:09 +0000] info [cpaneld] 170.254.82.29 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.144.65.21
country_id: 6252001
description:
[2026-06-27 01:22:41 +0000] info [cpaneld] 47.144.65.21 - wellci "GET /login/?login_only=1&user=wellci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.146.170.99
country_id: 6252001
description:
[2026-06-27 01:22:31 +0000] info [cpaneld] 47.146.170.99 - wellcity "GET /login/?login_only=1&user=wellcity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.105.213.115
country_id: 3865483
description:
[2026-06-27 01:22:54 +0000] info [cpaneld] 181.105.213.115 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.247.15
country_id: 2542007
description:
[2026-06-27 01:22:57 +0000] info [cpaneld] 196.117.247.15 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.234.214.157
country_id: 1562822
description:
[2026-06-27 01:23:21 +0000] info [cpaneld] 125.234.214.157 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.243.32.16
country_id: 102358
description:
[2026-06-27 01:23:13 +0000] info [cpaneld] 37.243.32.16 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.207.0.151
country_id: 2287781
description:
[2026-06-27 01:26:06 +0000] info [cpaneld] 102.207.0.151 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.152.39
country_id: 99237
description:
[2026-06-27 01:26:08 +0000] info [cpaneld] 185.244.152.39 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.212.247
country_id: 2017370
description:
[2026-06-27 01:25:52 +0000] info [cpaneld] 95.26.212.247 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.188.11
country_id: 6252001
description:
[2026-06-27 01:25:55 +0000] info [cpaneld] 172.251.188.11 - togofeedcom "GET /login/?login_only=1&user=togofeedcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeedcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.152.117.112
country_id: 1168579
description:
[2026-06-27 01:26:00 +0000] info [cpaneld] 103.152.117.112 - togofee "GET /login/?login_only=1&user=togofee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.253.242.116
country_id: 3686110
description:
[2026-06-27 01:26:12 +0000] info [cpaneld] 177.253.242.116 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.197.67.158
country_id: 3469034
description:
[2026-06-27 01:26:17 +0000] info [cpaneld] 177.197.67.158 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.96.114.66
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1701984512 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.44.172
country_id: 1562822
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-voici-le-decoupage-de-lannee-scolaire-et-universitaire-2021-2022/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.3.147.35
country_id: 2464461
description:
[2026-06-27 01:29:40 +0000] info [cpaneld] 197.3.147.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.104.178.193
country_id: 2017370
description:
[2026-06-27 01:29:42 +0000] info [cpaneld] 95.104.178.193 - davakconsulting "GET /login/?login_only=1&user=davakconsulting&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulting (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [27/Jun/2026:01:31:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184037&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782523862 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.231.203.27
country_id: 51537
description:
[2026-06-27 01:30:12 +0000] info [cpaneld] 197.231.203.27 - dava "GET /login/?login_only=1&user=dava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dava (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.117.119.30
country_id: 1522867
description:
[2026-06-27 01:30:22 +0000] info [cpaneld] 85.117.119.30 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.148.10.51
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 45.148.10.51: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.124.210.104
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1261557109 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [27/Jun/2026:01:32:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182744&pdata=http%253A%252F%252Fcfpj.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782523947 HTTP/1.1" 302 0 cfpj.tg "http://cfpj.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [27/Jun/2026:01:32:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868700&pdata=http%253A%252F%252Fwww.snb.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782523957 HTTP/1.1" 302 0 www.snb.tg "http://www.snb.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.132.198.71
country_id: 6252001
description:
[2026-06-27 01:32:24 +0000] info [whostmgrd] 57.132.198.71 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.88.238
country_id: 6252001
description:
47.251.88.238 - - [27/Jun/2026:01:32:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13331608&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782523958 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.88.238


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.191.206.37
country_id: 3017382
description:
[2026-06-27 01:32:49 +0000] info [cpaneld] 88.191.206.37 - daul "GET /login/?login_only=1&user=daul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user daul (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.220.146
country_id: 6252001
description:
47.77.220.146 - - [27/Jun/2026:01:32:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260822&pdata=http%253A%252F%252Fsia-togo.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782523968 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.220.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [27/Jun/2026:01:32:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950682&pdata=http%253A%252F%252Ftdn.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782523947 HTTP/1.1" 302 0 tdn.tg "http://tdn.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [27/Jun/2026:01:32:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051372&pdata=http%253A%252F%252F154.70.82.246%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782523958 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.73.171.187
country_id: 3469034
description:
[2026-06-27 01:32:38 +0000] info [cpaneld] 177.73.171.187 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.37.127.239
country_id: 3469034
description:
[2026-06-27 01:33:36 +0000] info [cpaneld] 177.37.127.239 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.72.194.154
country_id: 2542007
description:
[2026-06-27 01:33:39 +0000] info [cpaneld] 105.72.194.154 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.129.142.21
country_id: 3625428
description:
[2026-06-27 01:33:48 +0000] info [cpaneld] 38.129.142.21 - lv "GET /login/?login_only=1&user=lv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.92.87
country_id: 1282988
description:
[2026-06-27 01:33:32 +0000] info [cpaneld] 202.51.92.87 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.203.4
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190818-WA0059.jpg 400w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190818-WA0059-150x150.jpg 150w, http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190818-WA0059-300x300.jpg 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.193.137
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1353533442 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.41.2
country_id: 2017370
description:
[2026-06-27 01:36:29 +0000] info [cpaneld] 95.26.41.2 - sophieimmobilier "GET /login/?login_only=1&user=sophieimmobilier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieimmobilier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.177.114.149
country_id: 6252001
description:
[2026-06-27 01:36:35 +0000] info [cpaneld] 98.177.114.149 - sophieimmo "GET /login/?login_only=1&user=sophieimmo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieimmo (has_cpuser_file failed)


