# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.21.103
country_id: 1880251
description:
85.203.21.103 - - [26/Jun/2026:04:43:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608904&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZmFyYWhAYWNvbGl0ZS5jb20ubXk%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782448996 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZmFyYWhAYWNvbGl0ZS5jb20ubXk=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.21.103


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.117.63.206
country_id: 1210997
description:
45.117.63.206 - - [26/Jun/2026:04:44:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448790&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Farzouma-natchadja%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782449067 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/arzouma-natchadja/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.117.63.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.40
country_id: 2921044
description:
2026-06-26 04:44:56 dovecot_plain authenticator failed for H=tor-exit-40.for-privacy.net (822sqtb1s07iaat16p9vyvvr) [185.220.101.40]:50899: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.86.66
country_id: 1512440
description:
[2026-06-26 04:45:59 +0000] info [cpaneld] 213.230.86.66 - scafricaplccom "GET /login/?login_only=1&user=scafricaplccom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafricaplccom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.14.131.176
country_id: 3625428
description:
[2026-06-26 04:45:52 +0000] info [cpaneld] 186.14.131.176 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.23.44.29
country_id: 2361809
description:
[2026-06-26 04:46:05 +0000] info [cpaneld] 102.23.44.29 - scafric "GET /login/?login_only=1&user=scafric&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafric (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.44.104.211
country_id: 1210997
description:
[2026-06-26 04:46:10 +0000] info [cpaneld] 202.44.104.211 - scafri "GET /login/?login_only=1&user=scafri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.63.108
country_id: 99237
description:
[2026-06-26 04:45:55 +0000] info [cpaneld] 169.224.63.108 - scafricaplc "GET /login/?login_only=1&user=scafricaplc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafricaplc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.248.205.10
country_id: 1210997
description:
[2026-06-26 04:46:14 +0000] info [cpaneld] 103.248.205.10 - scafr "GET /login/?login_only=1&user=scafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.153.170.200
country_id: 1210997
description:
[2026-06-26 04:46:26 +0000] info [cpaneld] 103.153.170.200 - sca "GET /login/?login_only=1&user=sca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sca (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.87
country_id: 798544
description:
Jun 26 04:47:14 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.42.245.165
country_id: 6252001
description:
[2026-06-26 04:48:31 +0000] info [whostmgrd] 193.42.245.165 - NS4 "POST /login/?login HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.13.56
country_id: 241170
description:
[2026-06-26 04:50:30 +0000] info [cpaneld] 31.134.13.56 - admin "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.55.5
country_id: 3608932
description:
Jun 26 04:52:05 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.55.5 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.226.234
country_id: 2077456
domain: www.djama.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:46.203.226.234||TA:46.203.226.234||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.55.5
country_id: 3608932
description:
Jun 26 04:52:11 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.55.5 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.204.133
country_id: 3190538
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:209.242.204.133||TA:209.242.204.133||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.151.190.85
country_id: 6252001
description:
[2026-06-26 04:53:11 +0000] info [cpaneld] 193.151.190.85 - yvwaocrr "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.113.172.85
country_id: 1210997
description:
[2026-06-26 04:58:04 +0000] info [cpaneld] 103.113.172.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.8.214.169
country_id: 3686110
description:
[2026-06-26 04:58:07 +0000] info [cpaneld] 190.8.214.169 - smarty "GET /login/?login_only=1&user=smarty&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smarty (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.184.68
country_id: 3437598
description:
[2026-06-26 04:58:22 +0000] info [cpaneld] 181.117.184.68 - sm "GET /login/?login_only=1&user=sm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.129.150.127
country_id: 2017370
description:
[2026-06-26 04:58:13 +0000] info [cpaneld] 31.129.150.127 - smart "GET /login/?login_only=1&user=smart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smart (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.79.88.199
country_id: 3686110
description:
[2026-06-26 04:58:16 +0000] info [cpaneld] 181.79.88.199 - smar "GET /login/?login_only=1&user=smar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smar (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [26/Jun/2026:05:00:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844053&pdata=https%253A%252F%252Fsoena.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782450050 HTTP/2.0" 302 0 soena.tg "https://soena.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [26/Jun/2026:05:00:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997356&pdata=https%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782450050 HTTP/2.0" 302 0 154.70.82.249 "https://154.70.82.249/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.26
country_id: 6252001
description:
205.169.39.26 - - [26/Jun/2026:05:01:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646893&pdata=http%253A%252F%252Fahoefa.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782450069 HTTP/1.1" 302 0 ahoefa.tg "http://ahoefa.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.26


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.243.40
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.245.243.40||TA:104.245.243.40||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.136.186
country_id: 2017370
description:
[2026-06-26 05:09:28 +0000] info [cpaneld] 109.252.136.186 - soroubattg "GET /login/?login_only=1&user=soroubattg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubattg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.237.188.46
country_id: 3686110
description:
[2026-06-26 05:09:45 +0000] info [cpaneld] 181.237.188.46 - sor "GET /login/?login_only=1&user=sor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.178.117.87
country_id: 3658394
description:
[2026-06-26 05:09:26 +0000] info [cpaneld] 186.178.117.87 - soroubat "GET /login/?login_only=1&user=soroubat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.223.144
country_id: 2287781
description:
[2026-06-26 05:09:38 +0000] info [cpaneld] 102.209.223.144 - sorou "GET /login/?login_only=1&user=sorou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.75.90.242
country_id: 2542007
description:
[2026-06-26 05:10:24 +0000] info [cpaneld] 196.75.90.242 - tchamba "GET /login/?login_only=1&user=tchamba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.96.230.22
country_id: 2017370
description:
[2026-06-26 05:10:26 +0000] info [cpaneld] 176.96.230.22 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.114.6.128
country_id: 2017370
description:
[2026-06-26 05:10:35 +0000] info [cpaneld] 188.114.6.128 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.159
country_id: 99237
description:
[2026-06-26 05:10:16 +0000] info [cpaneld] 185.24.61.159 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.139.152
country_id: 3895114
description:
[2026-06-26 05:10:20 +0000] info [cpaneld] 181.43.139.152 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.9.211.97
country_id: 3865483
description:
[2026-06-26 05:14:10 +0000] info [cpaneld] 181.9.211.97 - dero "GET /login/?login_only=1&user=dero&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dero (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.48.134.98
country_id: 2264397
description:
[2026-06-26 05:14:01 +0000] info [cpaneld] 109.48.134.98 - derou "GET /login/?login_only=1&user=derou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user derou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.125.59
country_id: 3469034
description:
[2026-06-26 05:14:07 +0000] info [cpaneld] 181.189.125.59 - deroutg "GET /login/?login_only=1&user=deroutg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deroutg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.10.128.250
country_id: 3469034
description:
[2026-06-26 05:14:20 +0000] info [cpaneld] 177.10.128.250 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.113.106.3
country_id: 3686110
description:
[2026-06-26 05:14:14 +0000] info [cpaneld] 186.113.106.3 - der "GET /login/?login_only=1&user=der&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user der (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.244.211.48
country_id: 1562822
description:
[2026-06-26 05:17:03 +0000] info [cpaneld] 14.244.211.48 - sotranet "GET /login/?login_only=1&user=sotranet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 200.33.128.3
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 200.33.128.3: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.1.73.42
country_id: 3469034
description:
[2026-06-26 05:17:55 +0000] info [cpaneld] 201.1.73.42 - mftogo "GET /login/?login_only=1&user=mftogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.220.18.41
country_id: 3865483
description:
[2026-06-26 05:17:59 +0000] info [cpaneld] 201.220.18.41 - mftog "GET /login/?login_only=1&user=mftog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.111.100.123
country_id: 3469034
description:
[2026-06-26 05:18:03 +0000] info [cpaneld] 179.111.100.123 - mfto "GET /login/?login_only=1&user=mfto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mfto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.233.159.29
country_id: 3469034
description:
[2026-06-26 05:18:06 +0000] info [cpaneld] 45.233.159.29 - mft "GET /login/?login_only=1&user=mft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mft (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 200.33.128.2
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 200.33.128.2: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.124.19.89
country_id: 2017370
description:
[2026-06-26 05:18:09 +0000] info [cpaneld] 212.124.19.89 - mf "GET /login/?login_only=1&user=mf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mf (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.250.204.184
country_id: 3144096
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.250.204.184||TA:104.250.204.184||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.215.109
country_id: 3923057
description:
2026-06-26 05:21:26 dovecot_plain authenticator failed for H=(localhost) [181.115.215.109]:61297: 535 Incorrect authentication data (set_id=atssarl@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.198.98.83
country_id: 1694008
description:
2026-06-26 05:22:13 dovecot_plain authenticator failed for H=(localhost) [112.198.98.83]:22740: 535 Incorrect authentication data (set_id=kmjeanne@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.220.21.203
country_id: 3865483
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/site HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.220.21.203
country_id: 3865483
domain: cfpj.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tghttp/cfpj.tg/site HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.109.78
country_id: 99237
description:
[2026-06-26 05:29:06 +0000] info [cpaneld] 185.181.109.78 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.103.229.254
country_id: 2635167
description:
[2026-06-26 05:29:10 +0000] info [cpaneld] 212.103.229.254 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.227.143.62
country_id: 1643084
description:
[2026-06-26 05:28:59 +0000] info [cpaneld] 103.227.143.62 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.109.45
country_id: 3686110
description:
[2026-06-26 05:29:27 +0000] info [cpaneld] 191.102.109.45 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.99.37.36
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-30.138.99.37.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.35.115.65
country_id: 2017370
description:
[2026-06-26 05:29:15 +0000] info [cpaneld] 5.35.115.65 - vitri "GET /login/?login_only=1&user=vitri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitri (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.248.171.23
country_id: 2750405
description:
89.248.171.23 - - [26/Jun/2026:05:30:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054035&pdata=http%253A%252F%252Fwww.kics.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782451827 HTTP/1.1" 302 0 www.kics.kpmg.tg "http://www.kics.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.248.171.23


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.68.139
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:152.232.68.139||TA:152.232.68.139||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.109.40.202
country_id: 294640
description:
[2026-06-26 05:32:47 +0000] info [cpaneld] 84.109.40.202 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.184.53.139
country_id: 6254930
description:
[2026-06-26 05:32:49 +0000] info [cpaneld] 85.184.53.139 - banmlab "GET /login/?login_only=1&user=banmlab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.86.137.175
country_id: 3625428
description:
[2026-06-26 05:32:52 +0000] info [cpaneld] 82.86.137.175 - banmlabtg "GET /login/?login_only=1&user=banmlabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.116.56.17
country_id: 3865483
description:
[2026-06-26 05:33:03 +0000] info [cpaneld] 181.116.56.17 - ban "GET /login/?login_only=1&user=ban&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ban (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.145.113.119
country_id: 1210997
description:
[2026-06-26 05:33:08 +0000] info [cpaneld] 103.145.113.119 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.108.246.16
country_id: 3865483
description:
[2026-06-26 05:33:51 +0000] info [cpaneld] 186.108.246.16 - crechepetitelune "GET /login/?login_only=1&user=crechepetitelune&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelune (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.192.228.92
country_id: 1512440
description:
2026-06-26 05:33:56 H=([87.192.228.92]) [87.192.228.92]:50519 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.179.240
country_id: 3625428
description:
[2026-06-26 05:34:01 +0000] info [cpaneld] 38.137.179.240 - crechep "GET /login/?login_only=1&user=crechep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.88.159.179
country_id: 298795
description:
[2026-06-26 05:34:26 +0000] info [cpaneld] 176.88.159.179 - mediato "GET /login/?login_only=1&user=mediato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.206.123.218
country_id: 2287781
description:
[2026-06-26 05:34:14 +0000] info [cpaneld] 102.206.123.218 - cre "GET /login/?login_only=1&user=cre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.233.37.83
country_id: 3469034
description:
[2026-06-26 05:34:17 +0000] info [cpaneld] 186.233.37.83 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.239.99.207
country_id: 6254930
description:
[2026-06-26 05:34:11 +0000] info [cpaneld] 103.239.99.207 - crec "GET /login/?login_only=1&user=crec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.135.84.93
country_id: 953987
description:
[2026-06-26 05:34:17 +0000] info [cpaneld] 41.135.84.93 - mediatopnews "GET /login/?login_only=1&user=mediatopnews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.71.89.68
country_id: 3469034
description:
[2026-06-26 05:34:23 +0000] info [cpaneld] 45.71.89.68 - mediatop "GET /login/?login_only=1&user=mediatop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.93.204.61
country_id: 3865483
description:
[2026-06-26 05:34:37 +0000] info [cpaneld] 190.93.204.61 - medi "GET /login/?login_only=1&user=medi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user medi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.40.24
country_id: 1562822
description:
[2026-06-26 05:34:44 +0000] info [cpaneld] 14.191.40.24 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.222.205.162
country_id: 3895114
description:
[2026-06-26 05:34:32 +0000] info [cpaneld] 148.222.205.162 - media "GET /login/?login_only=1&user=media&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user media (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.103.229.254
country_id: 2635167
description:
[2026-06-26 05:34:58 +0000] info [whostmgrd] 212.103.229.254 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.196.206.138
country_id: 2017370
description:
[2026-06-26 05:34:20 +0000] info [cpaneld] 176.196.206.138 - mediatopnewstg "GET /login/?login_only=1&user=mediatopnewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnewstg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.71.229
country_id: 1694008
description:
2026-06-26 05:36:25 dovecot_plain authenticator failed for H=(localhost) [138.84.71.229]:63273: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.115.242
country_id: 1694008
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/hellessy-resort-2017/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.239.163.136
country_id: 3932488
description:
[2026-06-26 05:40:05 +0000] info [cpaneld] 190.239.163.136 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.123.210.99
country_id: 1819730
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:190.123.210.99||TA:190.123.210.99||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.220.240
country_id: 3996063
description:
[2026-06-26 05:40:00 +0000] info [cpaneld] 177.245.220.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.225.237.99
country_id: 3469034
description:
[2026-06-26 05:40:10 +0000] info [cpaneld] 186.225.237.99 - fundacionesperanzatogotg "GET /login/?login_only=1&user=fundacionesperanzatogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.168.165.209
country_id: 1605651
description:
[2026-06-26 05:40:21 +0000] info [cpaneld] 110.168.165.209 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.126.91
country_id: 3686110
description:
[2026-06-26 05:41:03 +0000] info [cpaneld] 45.162.126.91 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.64.26
country_id: 3996063
description:
[2026-06-26 05:41:08 +0000] info [cpaneld] 129.222.64.26 - zephyrtg "GET /login/?login_only=1&user=zephyrtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyrtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.22.7.111
country_id: 3865483
description:
[2026-06-26 05:40:25 +0000] info [cpaneld] 161.22.7.111 - fundac "GET /login/?login_only=1&user=fundac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.134.242.177
country_id: 3439705
description:
[2026-06-26 05:40:28 +0000] info [cpaneld] 190.134.242.177 - funda "GET /login/?login_only=1&user=funda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user funda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.58.74.2
country_id: 6254930
description:
[2026-06-26 05:40:30 +0000] info [cpaneld] 194.58.74.2 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.151.199
country_id: 3469034
description:
[2026-06-26 05:40:34 +0000] info [cpaneld] 45.178.151.199 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.255.107.74
country_id: 3932488
description:
[2026-06-26 05:40:37 +0000] info [cpaneld] 38.255.107.74 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.154.156.9
country_id: 1210997
description:
[2026-06-26 05:41:16 +0000] info [cpaneld] 103.154.156.9 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.85.211.127
country_id: 3437598
description:
[2026-06-26 05:43:11 +0000] info [cpaneld] 181.85.211.127 - alloacio "GET /login/?login_only=1&user=alloacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.183.58.189
country_id: 3658394
description:
[2026-06-26 05:43:23 +0000] info [cpaneld] 201.183.58.189 - alloac "GET /login/?login_only=1&user=alloac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.87.145.196
country_id: 3469034
description:
[2026-06-26 05:43:28 +0000] info [cpaneld] 179.87.145.196 - alloa "GET /login/?login_only=1&user=alloa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.192.53
country_id: 1512440
description:
[2026-06-26 05:43:39 +0000] info [cpaneld] 144.124.192.53 - all "GET /login/?login_only=1&user=all&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user all (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.94.102.143
country_id: 3469034
description:
[2026-06-26 05:43:20 +0000] info [cpaneld] 138.94.102.143 - alloaci "GET /login/?login_only=1&user=alloaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.131.157
country_id: 3469034
description:
[2026-06-26 05:43:44 +0000] info [cpaneld] 168.196.131.157 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.115
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.141.129
country_id: 2635167
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:107.181.141.129||TA:107.181.141.129||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.242.114.139
country_id: 6251999
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:196.242.114.139||TA:196.242.114.139||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.173
country_id: 1880251
description:
47.128.121.173 - - [26/Jun/2026:05:53:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144199&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fkoffi-joseph-tsigbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782453179 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/koffi-joseph-tsigbe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.173


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.188.62.58
country_id: 6252001
description:
54.188.62.58 - - [26/Jun/2026:05:53:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788244&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782453191 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/index.php?cmd=newupld" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.188.62.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.173
country_id: 1880251
description:
47.128.121.173 - - [26/Jun/2026:05:54:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527079&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fla-recherche-et-de-linnovation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782453250 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/la-recherche-et-de-linnovation/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.173


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.219.178.227
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.219.178.227: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.135
country_id: 1880251
description:
47.128.121.135 - - [26/Jun/2026:06:00:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949662&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fofficiers%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782453622 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/officiers/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.135


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 177.234.138.198
country_id: 1269750
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:177.234.138.198||TA:177.234.138.198||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 101.43.172.58
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/rideau-sur-les-travaux-de-la-1ere-session-ordinaire-du-crk-pour-lannee-2026/<script async src=||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 152.136.157.145
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/formation-a-lintegrite-la-haplucia-agit-a-luniversite-de-kara/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.75.139.217
country_id: 2017370
description:
[2026-06-26 06:03:01 +0000] info [cpaneld] 94.75.139.217 - nstre "GET /login/?login_only=1&user=nstre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.157.28
country_id: 1210997
description:
[2026-06-26 06:03:11 +0000] info [cpaneld] 114.130.157.28 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.241.13.8
country_id: 2017370
description:
[2026-06-26 06:03:03 +0000] info [cpaneld] 92.241.13.8 - nstr "GET /login/?login_only=1&user=nstr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.172.224.172
country_id: 630336
description:
[2026-06-26 06:02:40 +0000] info [cpaneld] 178.172.224.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.150.97.222
country_id: 3469034
description:
[2026-06-26 06:02:47 +0000] info [cpaneld] 170.150.97.222 - nstreamprocom "GET /login/?login_only=1&user=nstreamprocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamprocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.121.206.44
country_id: 1733045
description:
[2026-06-26 06:02:59 +0000] info [cpaneld] 121.121.206.44 - nstrea "GET /login/?login_only=1&user=nstrea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstrea (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.222.211.59
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/nouvelles-fonctionnalites-du-sigpc-les-maires-du-grand-lome-outilles/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.75.169.66
country_id: 3469034
description:
[2026-06-26 06:05:47 +0000] info [cpaneld] 189.75.169.66 - ameakco "GET /login/?login_only=1&user=ameakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.180.89.71
country_id: 2361809
description:
[2026-06-26 06:05:55 +0000] info [cpaneld] 102.180.89.71 - am "GET /login/?login_only=1&user=am&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user am (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.140.70.32
country_id: 6254930
description:
[2026-06-26 06:07:39 +0000] info [cpaneld] 158.140.70.32 - expertsdefensecom "GET /login/?login_only=1&user=expertsdefensecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsdefensecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.100.67
country_id: 2017370
description:
[2026-06-26 06:07:42 +0000] info [cpaneld] 77.222.100.67 - expertsd "GET /login/?login_only=1&user=expertsd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.53.121
country_id: 290557
description:
[2026-06-26 06:07:47 +0000] info [cpaneld] 176.205.53.121 - experts "GET /login/?login_only=1&user=experts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user experts (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.65.111.121
country_id: 3277605
description:
[2026-06-26 06:08:08 +0000] info [cpaneld] 128.65.111.121 - ex "GET /login/?login_only=1&user=ex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ex (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.31.153.135
country_id: 1210997
description:
103.31.153.135 - - [26/Jun/2026:06:11:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931820&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-75067tetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782454295 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-75067tetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.31.153.135


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 198.44.167.10
country_id: 6252001
domain: lasnb.com
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.242.13.213
country_id: 2017370
description:
[2026-06-26 06:16:14 +0000] info [cpaneld] 46.242.13.213 - davakconsultingcom "GET /login/?login_only=1&user=davakconsultingcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsultingcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.211.216.180
country_id: 3658394
description:
[2026-06-26 06:16:40 +0000] info [cpaneld] 181.211.216.180 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.194.132.38
country_id: 290557
description:
[2026-06-26 06:16:11 +0000] info [cpaneld] 5.194.132.38 - davakconsulting "GET /login/?login_only=1&user=davakconsulting&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulting (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.40.61.69
country_id: 2017370
description:
[2026-06-26 06:16:17 +0000] info [cpaneld] 77.40.61.69 - davakcon "GET /login/?login_only=1&user=davakcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakcon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.51.209.56
country_id: 3686110
description:
[2026-06-26 06:16:25 +0000] info [cpaneld] 181.51.209.56 - davak "GET /login/?login_only=1&user=davak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davak (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.79.251.135
country_id: 3469034
description:
170.79.251.135 - - [26/Jun/2026:06:17:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146220&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Flions-club%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782454637 HTTP/2.0" 302 0 direct7.tg "-" "Mozilla/5.0 (Linux; Android 12; SM-N970U Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/139.0.7258.160 Mobile Safari/537.36 BingSapphire/21.0.390204302" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.79.251.135


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.153.83.230
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 61.153.83.230: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.153.81.197
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 61.153.81.197: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.153.83.229
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 61.153.83.229: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.153.81.196
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 61.153.81.196: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.62.222.9
country_id: 2017370
description:
[2026-06-26 06:21:31 +0000] info [cpaneld] 109.62.222.9 - zontalomemilleniumtg "GET /login/?login_only=1&user=zontalomemilleniumtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemilleniumtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.188.213.10
country_id: 3865483
description:
[2026-06-26 06:21:44 +0000] info [cpaneld] 190.188.213.10 - zonta "GET /login/?login_only=1&user=zonta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zonta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.131.53.139
country_id: 6252001
description:
[2026-06-26 06:21:29 +0000] info [cpaneld] 107.131.53.139 - zontalomemillenium "GET /login/?login_only=1&user=zontalomemillenium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemillenium (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.138.206.247
country_id: 6252001
description:
[2026-06-26 06:21:40 +0000] info [cpaneld] 74.138.206.247 - zontal "GET /login/?login_only=1&user=zontal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.35.247
country_id: 3895114
description:
[2026-06-26 06:21:50 +0000] info [cpaneld] 138.84.35.247 - zont "GET /login/?login_only=1&user=zont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.148.138.90
country_id: 102358
description:
[2026-06-26 06:21:38 +0000] info [cpaneld] 90.148.138.90 - zontalo "GET /login/?login_only=1&user=zontalo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.233.17.205
country_id: 3469034
description:
[2026-06-26 06:22:49 +0000] info [cpaneld] 181.233.17.205 - centi "GET /login/?login_only=1&user=centi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user centi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.161.184.71
country_id: 6252001
description:
[2026-06-26 06:22:54 +0000] info [cpaneld] 68.161.184.71 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 184.72.115.35
country_id: 6252001
description:
184.72.115.35 - - [26/Jun/2026:06:25:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328176&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782271628 HTTP/1.1" 404 159 ucao-uut.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:184.72.115.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-26 06:27:40 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:57084: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 91.230.225.250
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/SimplePie/autoloader.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [26/Jun/2026:06:30:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328425&pdata=http%253A%252F%252F154.70.82.244&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782455406 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.173.240.183
country_id: 3469034
description:
[2026-06-26 06:30:59 +0000] info [cpaneld] 45.173.240.183 - togofe "GET /login/?login_only=1&user=togofe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.161
country_id: 690791
description:
Jun 26 06:30:33 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.153.6.246
country_id: 3625428
description:
[2026-06-26 06:30:35 +0000] info [cpaneld] 190.153.6.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.35.55.176
country_id: 2017370
description:
[2026-06-26 06:31:08 +0000] info [cpaneld] 5.35.55.176 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.169.94.163
country_id: 1210997
description:
[2026-06-26 06:30:39 +0000] info [cpaneld] 103.169.94.163 - alloacio "GET /login/?login_only=1&user=alloacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.251.231.97
country_id: 1210997
description:
[2026-06-26 06:30:49 +0000] info [cpaneld] 45.251.231.97 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.47.49
country_id: 953987
description:
Jun 26 06:31:01 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.47.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.138.46.4
country_id: 3996063
description:
[2026-06-26 06:31:04 +0000] info [cpaneld] 189.138.46.4 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.177.154.38
country_id: 3996063
description:
[2026-06-26 06:30:56 +0000] info [cpaneld] 189.177.154.38 - togofee "GET /login/?login_only=1&user=togofee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.50.14.162
country_id: 3658394
description:
[2026-06-26 06:31:06 +0000] info [cpaneld] 27.50.14.162 - all "GET /login/?login_only=1&user=all&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user all (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.218.11.78
country_id: 3469034
description:
[2026-06-26 06:31:07 +0000] info [cpaneld] 179.218.11.78 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.81
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/sodium_compat/src/Crypto32.php||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.89
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/sodium_compat/src/SodiumException.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.193.30.6
country_id: 3469034
description:
[2026-06-26 06:31:12 +0000] info [cpaneld] 186.193.30.6 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 91.230.225.251
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/sodium_compat/autoload-php7.php||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.71.99
country_id: 2635167
domain: matosshop.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/iaxtjfpj/public_html/wp-includes/sodium_compat/src/Compat.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.100
country_id: 3175395
description:
Jun 26 06:32:14 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.137.64.39
country_id: 294640
description:
[2026-06-26 06:34:26 +0000] info [cpaneld] 77.137.64.39 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:214ff72bf06983b9bdafabbab68edbd09f44505b||Title:xe31gafuixpt99s||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.39.104.198
country_id: 3469034
description:
[2026-06-26 06:34:31 +0000] info [cpaneld] 177.39.104.198 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5e1a140a7699b1ead24ae9b8be1b7c431834801||Title:kdog51gj6zbf2qb||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc3c64f5f4ee0696b71049fcba0a0f49f8b63986||Title:giqi19rbqyoq6v99tg||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.235.9
country_id: 3469034
description:
[2026-06-26 06:37:35 +0000] info [cpaneld] 45.190.235.9 - dagl "GET /login/?login_only=1&user=dagl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagl (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75b460f44ce720af30b5939a2cb0cce898375eca||Title:mnhvt8nkfh9p8wk8||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.167.233.2
country_id: 1282988
description:
103.167.233.2 - - [26/Jun/2026:06:38:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515047&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-202603zetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782455912 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-202603zetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.167.233.2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.68.43.17
country_id: 6252001
description:
[2026-06-26 06:40:43 +0000] info [cpaneld] 138.68.43.17 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:35dff3399b6270e8782497a2e423e397bc8d706c||Title:q9ea9vdclvy7h4mvs||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 90.166.55.98
country_id: 2510769
domain: cafeit.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69113.cafeit.tg||ServerName:cafeit.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d6dc109a87eb4d5f9ada2df542c067dc14d7f5a4||Title:0x549c8b67||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:db9c54c7b1d569bf230e29422b156f654208b94d||Title:456iaphfcb8b1anio0||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.99.134.253
country_id: 1168579
description:
Denial of Service (DoS) attack was discovered from 103.99.134.253: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.52.226.65
country_id: 6252001
description:
[2026-06-26 06:42:49 +0000] info [whostmgrd] 64.52.226.65 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58449059d7bd5d09a4eadd996e87aca53080bd7a||Title:nmpf7p1i979guiawa8||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d36e4b103db23ab0b6c475b5ab38e2b06dbc4945||Title:e42unepd2mbl4lel||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5a193f07d3ecce21b19876638ca53d240c97bd70||Title:ygmrz38f1i1p1zrzil||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d982199e8ed1977c0d1572e69ed80e9775caace||Title:58w03104gil450||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.90.124.36
country_id: 3042225
description:
91.90.124.36 - - [26/Jun/2026:06:47:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039332&pdata=http%253A%252F%252Fwww.kics.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782456466 HTTP/1.1" 302 0 www.kics.kpmg.tg "http://www.kics.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.90.124.36


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.180
country_id: 1880251
description:
43.172.195.180 - - [26/Jun/2026:06:48:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986083&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Ffoure-de-lome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782456479 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/foure-de-lome" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.180


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b743dd61474b443596de4115dd970561f8730c23||Title:8nme5lhymq8dr5q||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.65.253
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:107.172.65.253||TA:107.172.65.253||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:daf7466ca66c96e8cb6eade3b715624ca060d0d7||Title:nw2amvy2lbuk903blm||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.124.35
country_id: 298795
domain: case-afrique.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38537.case-afrique.tg||ServerName:case-afrique.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c2b26f46586cd2d7003744a95a0898b6dd9f85c||Title:0x8b040380||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [26/Jun/2026:06:49:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105993&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fismac%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782456571 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ismac/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:82091f6af7dcc15a06d4c30692fd5ff0a6a838fb||Title:aufy3bbilqpgzk||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-26 06:50:46 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-26 06:50:45 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4ac0e3514d264d57e9bdaa79b903bd64ae50277c||Title:ppihvp8wun18fz4||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f5e5d5871d7678c604a556ca128bce23f1eaa402||Title:duneri8uehdz8rc7iv||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2649c2d11419c00975e5fc3dd3202c2f353617f1||Title:oo72biy0u8qesbljbb||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.131.141.138
country_id: 298795
description:
[2026-06-26 06:55:01 +0000] info [cpaneld] 217.131.141.138 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.148.196
country_id: 1733045
description:
[2026-06-26 06:55:03 +0000] info [cpaneld] 161.142.148.196 - cfmi "GET /login/?login_only=1&user=cfmi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.227.185.60
country_id: 3469034
description:
[2026-06-26 06:55:10 +0000] info [cpaneld] 45.227.185.60 - cfm "GET /login/?login_only=1&user=cfm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfm (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc0433adcbd329efe6c481a5872dacada9479564||Title:2y4cuxyqp7044zg||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.159.79
country_id: 294640
description:
[2026-06-26 06:55:12 +0000] info [cpaneld] 79.177.159.79 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d3c483a606ceef9c1d0723019e02745329f8439e||Title:x1ukyvatix2ysu||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-26 06:56:06 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-26 06:56:07 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:98fe06a2e2cf7ec5f387fb5567470da0ad032c1a||Title:gl8c19yse10qlq2iz9||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.196.9.214
country_id: 6252001
description:
103.196.9.214 - - [26/Jun/2026:06:57:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053787&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fkara-mecontentement-a-la-societe-somac-partenaire-de-moov-togo%252Factualites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457067 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/kara-mecontentement-a-la-societe-somac-partenaire-de-moov-togo/actualites/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.6036.1890 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.196.9.214


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.211.226.76
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:855d2b770c02ff25ea6fee770d3b3d724745e520||Title:93qivhyl60aw87v||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.108.79.116
country_id: 3686110
description:
190.108.79.116 - - [26/Jun/2026:06:57:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065607&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouvelles-nominations-au-ministere-du-commerce%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457073 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouvelles-nominations-au-ministere-du-commerce/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4060.1465 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.108.79.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 153.67.7.147
country_id: 3865483
description:
153.67.7.147 - - [26/Jun/2026:06:59:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011503&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-51400mitems%252Fetidm75yn.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457193 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nwyj-51400mitems/etidm75yn.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:153.67.7.147


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.188.230.213
country_id: 3996063
description:
187.188.230.213 - - [26/Jun/2026:06:59:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581958&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457192 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.3877.1940 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.188.230.213


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.145.187.112
country_id: 1605651
description:
[2026-06-26 07:00:50 +0000] info [cpaneld] 27.145.187.112 - digili "GET /login/?login_only=1&user=digili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.98.134
country_id: 6252001
description:
[2026-06-26 07:00:52 +0000] info [whostmgrd] 76.38.98.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.63.99.14
country_id: 2186224
description:
[2026-06-26 07:00:56 +0000] info [cpaneld] 122.63.99.14 - digi "GET /login/?login_only=1&user=digi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.39.223.226
country_id: 2017370
description:
[2026-06-26 07:01:02 +0000] info [cpaneld] 92.39.223.226 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.152.227
country_id: 1880251
domain: expire.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:34.143.152.227||TA:34.143.152.227||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.98.140.92
country_id: 2589581
description:
105.98.140.92 - - [26/Jun/2026:07:02:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936817&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457347 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.3666.1565 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.98.140.92


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-26 07:03:27 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-26 07:03:25 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.213.176.10
country_id: 192950
description:
102.213.176.10 - - [26/Jun/2026:07:03:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052203&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurence-assignon-au-guinness-world-records%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457408 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurence-assignon-au-guinness-world-records/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2320.1456 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.213.176.10


plugin: modsec
rule: 77093094
abuser: 34.123.82.129
country_id: 6252001
domain: monde-ai.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_2c34f3ca\":null,\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_11a0a20f\":\"1f09a9507b17996c\",\"_response\":{\"_prefix\":\"var wqt=[].slice.call(arguments,1)[0];var wkea=wqt;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [26/Jun/2026:07:06:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262728&pdata=http%253A%252F%252Flct-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457568 HTTP/1.1" 302 0 lct-togo.tg "http://lct-togo.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [26/Jun/2026:07:06:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396823&pdata=http%253A%252F%252Ftogodailynews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457570 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [26/Jun/2026:07:06:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6386322&pdata=http%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457571 HTTP/1.1" 302 0 cafe.tg "http://cafe.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [26/Jun/2026:07:06:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984650&pdata=http%253A%252F%252Ftogodailynews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782457592 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: modsec
rule: 77093094
abuser: 34.123.82.129
country_id: 6252001
domain: moodle.free.netmaster.tg
description:


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.217.193.141
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/blocked.html HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.242.114.150
country_id: 6251999
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:196.242.114.150||TA:196.242.114.150||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.92.212
country_id: 6251999
description:
2026-06-26 07:10:57 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-c9-f1.cpe.i-zoom.net (cpc1-ersk4-2-0-cust471.know.cable.virginm.net) [24.244.92.212]:34353: 535 Incorrect authentication data (set_id=hkpeleka@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.7.145.123
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-39-prefectures-mobilisees-pour-la-campagne-de-reboisement-2026/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.73.83.138
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 182.73.83.138: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.79.26.26
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 182.79.26.26: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.60.52.178
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.23.198.80
country_id: 1643084
description:
[2026-06-26 07:20:58 +0000] info [cpaneld] 103.23.198.80 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.104.121.211
country_id: 3686110
description:
[2026-06-26 07:23:54 +0000] info [cpaneld] 191.104.121.211 - yanac "GET /login/?login_only=1&user=yanac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yanac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.34.168
country_id: 3895114
description:
[2026-06-26 07:24:06 +0000] info [cpaneld] 190.5.34.168 - ya "GET /login/?login_only=1&user=ya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.160.183.85
country_id: 2542007
description:
[2026-06-26 07:23:44 +0000] info [cpaneld] 160.160.183.85 - yanacom "GET /login/?login_only=1&user=yanacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yanacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.247.218.180
country_id: 102358
description:
[2026-06-26 07:23:59 +0000] info [cpaneld] 142.247.218.180 - yana "GET /login/?login_only=1&user=yana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.45.30
country_id: 3996063
description:
[2026-06-26 07:23:41 +0000] info [cpaneld] 189.203.45.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: mail.test.free.netmaster.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.136.206
country_id: 3658394
description:
[2026-06-26 07:24:11 +0000] info [cpaneld] 157.100.136.206 - togoagropolestg "GET /login/?login_only=1&user=togoagropolestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagropolestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.78.118.85
country_id: 3469034
description:
[2026-06-26 07:23:51 +0000] info [cpaneld] 170.78.118.85 - yanaco "GET /login/?login_only=1&user=yanaco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yanaco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.32.202.96
country_id: 2017370
description:
[2026-06-26 07:24:34 +0000] info [cpaneld] 193.32.202.96 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-06-26 07:24:56 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (liess) [174.58.87.108]:48404: 535 Incorrect authentication data (set_id=media@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.147.191.142
country_id: 1210997
description:
[2026-06-26 07:24:20 +0000] info [cpaneld] 27.147.191.142 - togoagro "GET /login/?login_only=1&user=togoagro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagro (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 165.231.98.165
country_id: 2750405
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:165.231.98.165||TA:165.231.98.165||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.46.232.247
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 193.46.232.247: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.1.101.27
country_id: 1694008
description:
[2026-06-26 07:24:27 +0000] info [cpaneld] 210.1.101.27 - togoag "GET /login/?login_only=1&user=togoag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.6.9.123
country_id: 3469034
description:
[2026-06-26 07:24:32 +0000] info [cpaneld] 189.6.9.123 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.209.187.99
country_id: 2921044
description:
[2026-06-26 07:24:36 +0000] info [cpaneld] 92.209.187.99 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.73.120.15
country_id: 2017370
description:
[2026-06-26 07:27:07 +0000] info [cpaneld] 46.73.120.15 - matoss "GET /login/?login_only=1&user=matoss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matoss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.255.16.169
country_id: 2589581
description:
[2026-06-26 07:27:09 +0000] info [cpaneld] 154.255.16.169 - matos "GET /login/?login_only=1&user=matos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.148.114.28
country_id: 1210997
description:
[2026-06-26 07:27:18 +0000] info [cpaneld] 103.148.114.28 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.22.200
country_id: 3932488
description:
[2026-06-26 07:27:14 +0000] info [cpaneld] 38.25.22.200 - mato "GET /login/?login_only=1&user=mato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mato (has_cpuser_file failed)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 41.78.139.212
country_id: 2363686
domain: cfmi.tg
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.20||T:APACHE||MVN:ARGS:classe||MV:seconde||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.43
country_id: 953987
description:
Jun 26 07:27:39 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.222.140.220
country_id: 241170
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2019/05/c4c4b210-fa62-494b-94cf-3ad20d2f554d-300x225.jpg HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 82.157.243.120
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/message-de-noel-la-laureate-nationale-sacree-avec-17-de-moyenne/<script async src=||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.127.224.145
country_id: 1269750
domain: confortis.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11385.confortis.tg||ServerName:confortis.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52d0ebd579c9347ad2e053d3344698c05d64e67e||Title:uaqqm3d5inhmb5j4||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.105.2.99
country_id: 2017370
description:
[2026-06-26 07:34:00 +0000] info [cpaneld] 95.105.2.99 - togoathletisme "GET /login/?login_only=1&user=togoathletisme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletisme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.171.182.217
country_id: 3686110
description:
[2026-06-26 07:34:09 +0000] info [cpaneld] 45.171.182.217 - togoathl "GET /login/?login_only=1&user=togoathl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathl (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-26 07:34:17 H=([77.83.39.59]) [77.83.39.59]:62969 F=<Nate.Gilmore@schuylerline.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.156.18.35
country_id: 3686110
description:
[2026-06-26 07:34:20 +0000] info [cpaneld] 191.156.18.35 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.205.54.50
country_id: 2017370
description:
[2026-06-26 07:34:22 +0000] info [cpaneld] 178.205.54.50 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.208.18
country_id: 1643084
description:
[2026-06-26 07:34:15 +0000] info [cpaneld] 157.85.208.18 - togoath "GET /login/?login_only=1&user=togoath&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoath (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 39.52.98.169
country_id: 1168579
description:
[2026-06-26 07:34:27 +0000] info [cpaneld] 39.52.98.169 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.38
country_id: 3469034
description:
Jun 26 07:37:06 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.38
country_id: 3469034
description:
Jun 26 07:37:12 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.122.123.86
country_id: 690791
description:
176.122.123.86 - - [26/Jun/2026:07:38:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251376&pdata=https%253A%252F%252Fcfpj.tg%252Fvivu-18208witems%252Fetidm20iv.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782459482 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/vivu-18208witems/etidm20iv.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.122.123.86


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-26 07:41:45 H=([77.83.39.59]) [77.83.39.59]:54871 F=<mei7@convertec.com.tw> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.119
country_id: 1880251
description:
43.173.178.119 - - [26/Jun/2026:07:43:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528360&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Feconomie%25252Finseed-bientot-une-collecte-de-donnees-de-reference-sur-les-indicateurs-de-waca-resip%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782459781 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Feconomie%2Finseed-bientot-une-collecte-de-donnees-de-reference-sur-les-indicateurs-de-waca-resip%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.119


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.180.49.184
country_id: 6252001
description:
[2026-06-26 07:43:06 +0000] info [whostmgrd] 24.180.49.184 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.249.113.66
country_id: 3996063
description:
[2026-06-26 07:47:07 +0000] info [cpaneld] 187.249.113.66 - wage "GET /login/?login_only=1&user=wage&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wage (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.251.233.160
country_id: 1562822
description:
[2026-06-26 07:46:59 +0000] info [cpaneld] 171.251.233.160 - wages "GET /login/?login_only=1&user=wages&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wages (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.234.34.162
country_id: 3865483
description:
[2026-06-26 07:47:04 +0000] info [cpaneld] 45.234.34.162 - wagestg "GET /login/?login_only=1&user=wagestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wagestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.23.32.96
country_id: 2361809
description:
[2026-06-26 07:47:12 +0000] info [cpaneld] 102.23.32.96 - wa "GET /login/?login_only=1&user=wa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wa (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.188.62.58
country_id: 6252001
description:
54.188.62.58 - - [26/Jun/2026:07:46:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130533&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782459972 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.196 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.188.62.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.99.38.174
country_id: 6252001
description:
[2026-06-26 07:47:23 +0000] info [whostmgrd] 73.99.38.174 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 196.170.20.141
country_id: 2363686
domain: hrm.mesyscom.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.20||T:APACHE||MVN:ARGS:classement||MV:ASC1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.8.182.235
country_id: 798544
description:
Jun 26 07:50:58 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.8.182.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.8.182.235
country_id: 798544
description:
Jun 26 07:51:11 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.8.182.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.62.78
country_id: 2363686
description:
[2026-06-26 07:52:07 +0000] info [cpaneld] 196.170.62.78 NEW qnlprotv:SnkmR6k6jqBb7Y70 address=196.170.62.78,app=cpaneld,creator=qnlprotv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.245.174.241
country_id: 290557
domain: davakconsulting.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40525.davakconsulting.com||ServerName:davakconsulting.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa9ebd18c53bde47368e27761bc4253f2a51c65d||Title:0xf3f6c41c||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.170
country_id: 1880251
description:
43.172.195.170 - - [26/Jun/2026:07:53:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924550&pdata=http%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttp%25253A%25252F%25252Ftogodailynews.tg%25252Fproenergie-un-projet-qui-electrifie-les-villages-et-les-rend-autonomes%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782460387 HTTP/1.1" 404 561 togodailynews.tg "http://togodailynews.tg/wp-json/oembed/1.0/embed?url=http%3A%2F%2Ftogodailynews.tg%2Fproenergie-un-projet-qui-electrifie-les-villages-et-les-rend-autonomes%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.159.106.222
country_id: 6252001
description:
[2026-06-26 07:52:50 +0000] info [whostmgrd] 73.159.106.222 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 77.90.185.5
country_id: 130758
domain: butodra.tg
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/5/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 77.90.185.5
country_id: 130758
domain: butodra.tg
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:8.20||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/5/feedback?_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.91.162.110
country_id: 3579143
description:
Jun 26 07:54:19 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.91.162.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.50.13
country_id: 6252001
description:
[2026-06-26 07:57:09 +0000] info [whostmgrd] 104.203.50.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.79.147.226
country_id: 2017370
description:
[2026-06-26 07:57:47 +0000] info [cpaneld] 77.79.147.226 - smarty "GET /login/?login_only=1&user=smarty&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smarty (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.215.170.140
country_id: 290557
description:
[2026-06-26 07:57:35 +0000] info [cpaneld] 31.215.170.140 - universcom "GET /login/?login_only=1&user=universcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.250.166.30
country_id: 1562822
description:
[2026-06-26 07:57:49 +0000] info [cpaneld] 171.250.166.30 - univers "GET /login/?login_only=1&user=univers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.31.94.219
country_id: 2921044
description:
[2026-06-26 07:57:52 +0000] info [cpaneld] 94.31.94.219 - univer "GET /login/?login_only=1&user=univer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.105.212
country_id: 2921044
description:
[2026-06-26 07:58:03 +0000] info [cpaneld] 92.208.105.212 - uni "GET /login/?login_only=1&user=uni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.200.130
country_id: 2542007
description:
[2026-06-26 07:58:06 +0000] info [cpaneld] 105.77.200.130 - sm "GET /login/?login_only=1&user=sm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.168.30
country_id: 3469034
description:
[2026-06-26 07:58:01 +0000] info [cpaneld] 177.124.168.30 - univ "GET /login/?login_only=1&user=univ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.243.207.217
country_id: 2921044
description:
[2026-06-26 07:58:05 +0000] info [cpaneld] 2.243.207.217 - un "GET /login/?login_only=1&user=un&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user un (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [26/Jun/2026:08:00:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985881&pdata=https%253A%252F%252Fwww.misstogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782460849 HTTP/2.0" 302 0 www.misstogo.tg "https://www.misstogo.tg/" "Mozilla/5.0 (Linux; Android 12; moto g41 Build/S3RWS32.138-29-5-5; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/es ByteFullLocale/es Region/MX AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.misstogo.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; moto g41 Build/S3RWS32.138-29-5-5; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/es ByteFullLocale/es Region/MX AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.150.19.102
country_id: 1210997
description:
103.150.19.102 - - [26/Jun/2026:08:02:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250138&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-135538oitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782460967 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-135538oitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.150.19.102


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.112.69.0
country_id: 3895114
description:
200.112.69.0 - - [26/Jun/2026:08:04:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949190&pdata=https%253A%252F%252Fdirect7.tg%252F%253Fp%253D9853&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782461077 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/?p=9853" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.112.69.0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.65.35
country_id: 3469034
description:
Jun 26 08:06:54 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.65.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-26 08:07:57 +0000] info [cpaneld] 102.176.253.226 NEW ucaouut:uvc1qrbEzHTW5bRf address=102.176.253.226,app=cpaneld,creator=ucaouut,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.134.218.23
country_id: 1227603
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/togo/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.52.99.133
country_id: 6252001
description:
[2026-06-26 08:10:07 +0000] info [cpaneld] 73.52.99.133 - banmlab "GET /login/?login_only=1&user=banmlab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlab (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.134.218.23
country_id: 1227603
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/author/togo/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.109.51.78
country_id: 2017370
description:
[2026-06-26 08:10:04 +0000] info [cpaneld] 89.109.51.78 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.232.202.36
country_id: 3469034
description:
[2026-06-26 08:10:10 +0000] info [cpaneld] 181.232.202.36 - banmlabtg "GET /login/?login_only=1&user=banmlabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.98.235.62
country_id: 290557
description:
[2026-06-26 08:10:20 +0000] info [cpaneld] 92.98.235.62 - banml "GET /login/?login_only=1&user=banml&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banml (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.110.179.196
country_id: 2464461
description:
[2026-06-26 08:10:25 +0000] info [cpaneld] 154.110.179.196 - banm "GET /login/?login_only=1&user=banm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.167.144.246
country_id: 3469034
description:
[2026-06-26 08:10:15 +0000] info [cpaneld] 45.167.144.246 - banmla "GET /login/?login_only=1&user=banmla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.138.173.198
country_id: 1210997
description:
[2026-06-26 08:10:29 +0000] info [cpaneld] 103.138.173.198 - ban "GET /login/?login_only=1&user=ban&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ban (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.28.149.175
country_id: 3469034
description:
[2026-06-26 08:10:34 +0000] info [cpaneld] 189.28.149.175 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.96.150.166
country_id: 6252001
description:
[2026-06-26 08:14:47 +0000] info [whostmgrd] 191.96.150.166 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 194.39.127.125
country_id: 2264397
description:
Denial of Service (DoS) attack was discovered from 194.39.127.125: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.132.174.224
country_id: 1819730
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/la-plateforme-bouge-avec-le-228-se-mobilise-pour-le-12e-forum-national-du-paysan-togolais/<script async src=||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350920
name: IM360 WAF: Time-based blind SQL injection
abuser: 103.247.13.170
country_id: 1643084
domain: brmn.tg
description:
IM360 WAF: Time-based blind SQL injection||MV:/community/recent/?wpfob=(SELECT/**/1/**/FROM/**/(SELECT/**/SLEEP(8))a)||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 103.247.13.170
country_id: 1643084
domain: brmn.tg
description:
IM360 WAF: Malformed URI Open Redirect Probe Detected||MV:/community/recent/?wpfob=(SELECT/**/1/**/FROM/**/(SELECT/**/SLEEP(8))a)||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.247.13.170
country_id: 1643084
domain: brmn.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:wpfob||MV:(SELECT/**/1/**/FROM/**/(SELECT/**/SLEEP(8))a)||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-26 08:18:12 +0000] info [cpaneld] 196.171.122.34 - mvfxewjz "GET /cpsess5438056330/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.203.169] != Current IP Address [196.171.122.34]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@cloud-et-racks.tg [06/26/2026:08:19:19 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@cloud-et-racks.tg


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cloud-racks@cloud-et-racks.tg [06/26/2026:08:25:44 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cloud-racks@cloud-et-racks.tg


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.221
country_id: 3017382
description:
[2026-06-26 08:25:58 +0000] info [cpaneld] 5.231.64.221 NEW wcnyaruu:6EmQ9iEHZsN0etwJ address=5.231.64.221,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cloudetracks [06/26/2026:08:26:31 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cloudetracks


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.202.16.159
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:193.202.16.159||TA:193.202.16.159||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.154.1.56
country_id: 3686110
description:
[2026-06-26 08:27:04 +0000] info [cpaneld] 186.154.1.56 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.105.23.5
country_id: 3996063
description:
[2026-06-26 08:26:57 +0000] info [cpaneld] 201.105.23.5 - togocarrierebetons "GET /login/?login_only=1&user=togocarrierebetons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.217.170
country_id: 1733045
description:
[2026-06-26 08:27:01 +0000] info [cpaneld] 180.74.217.170 - togocarrierebetonstg "GET /login/?login_only=1&user=togocarrierebetonstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetonstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.193.23
country_id: 1643084
description:
[2026-06-26 08:27:32 +0000] info [cpaneld] 182.9.193.23 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.71.11.91
country_id: 3469034
description:
[2026-06-26 08:27:12 +0000] info [cpaneld] 201.71.11.91 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.127.84.102
country_id: 1210997
description:
[2026-06-26 08:27:26 +0000] info [cpaneld] 103.127.84.102 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.177.43
country_id: 1562822
description:
[2026-06-26 08:27:19 +0000] info [cpaneld] 14.191.177.43 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.111.166.240
country_id: 3469034
description:
[2026-06-26 08:27:23 +0000] info [cpaneld] 179.111.166.240 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@cloud-et-racks.tg [06/26/2026:08:28:23 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@cloud-et-racks.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.67
country_id: 933860
description:
Jun 26 08:29:23 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.138.117.192
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/championnat-national-u16-don-bosco-et-swallows-se-partagent-les-trophees/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.160
country_id: 1880251
description:
43.172.196.160 - - [26/Jun/2026:08:31:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936283&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F23054&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782462693 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/23054" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.160


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.192
country_id: 1880251
description:
43.173.182.192 - - [26/Jun/2026:08:32:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999509&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-groupe-orabank-engage-a-servir-ses-clients-avec-rigueur-et-professionnalisme%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782462754 HTTP/1.1" 404 561 togodailynews.tg "https://togodailynews.tg/le-groupe-orabank-engage-a-servir-ses-clients-avec-rigueur-et-professionnalisme/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.192


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.31.111.168
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/09/IMG-20190902-WA0105.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2019/09/IMG-20190902-WA0105-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2019/09/IMG-20190902-WA0105-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2019/09/IMG-20190902-WA0105-272x182.jpg 272w HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.131.6
country_id: 294640
description:
[2026-06-26 08:34:25 +0000] info [cpaneld] 79.177.131.6 - fastsolution "GET /login/?login_only=1&user=fastsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.239.38.221
country_id: 3469034
description:
[2026-06-26 08:34:37 +0000] info [cpaneld] 170.239.38.221 - fastso "GET /login/?login_only=1&user=fastso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.110.42.140
country_id: 1562822
description:
[2026-06-26 08:34:54 +0000] info [cpaneld] 116.110.42.140 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.56.139
country_id: 3865483
description:
[2026-06-26 08:34:23 +0000] info [cpaneld] 186.22.56.139 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.242.14.242
country_id: 2017370
description:
[2026-06-26 08:34:48 +0000] info [cpaneld] 46.242.14.242 - fa "GET /login/?login_only=1&user=fa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.191.1.121
country_id: 3932488
description:
[2026-06-26 08:35:00 +0000] info [cpaneld] 132.191.1.121 - zephy "GET /login/?login_only=1&user=zephy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.238.88
country_id: 3865483
description:
[2026-06-26 08:34:30 +0000] info [cpaneld] 186.158.238.88 - fastsolu "GET /login/?login_only=1&user=fastsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.95.239
country_id: 3895114
description:
[2026-06-26 08:34:44 +0000] info [cpaneld] 45.232.95.239 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.96.81.121
country_id: 1522867
description:
[2026-06-26 08:34:51 +0000] info [cpaneld] 212.96.81.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.228.217.234
country_id: 1562822
description:
[2026-06-26 08:35:05 +0000] info [cpaneld] 171.228.217.234 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [26/Jun/2026:08:36:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856968&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782462981 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.190.220.38
country_id: 1168579
domain: sp-eau.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tghttp/sp-eau.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.190.220.38
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.204.4.192
country_id: 1814991
description:
116.204.4.192 - - [26/Jun/2026:08:37:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078106&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-login.php%253Fredirect_to%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Fcovid-19-au-togo-le-pnud-offre-3-cliniques-mobiles-au-gouvernement%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782463063 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-login.php?redirect_to=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Fcovid-19-au-togo-le-pnud-offre-3-cliniques-mobiles-au-gouvernement%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.204.4.192


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2026-06-26 08:37:40 dovecot_login authenticator failed for H=(nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:35203: 535 Incorrect authentication data (set_id=billing@cloud-et-racks.tg)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-26 08:39:36 +0000] info [whostmgrd] 80.248.64.198 NEW cndhtogo:XJE67EAB8ezqVP7o address=80.248.64.198,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-26 08:39:36 +0000] info [cpaneld] 80.248.64.198 NEW cndhtogo:_sriwHPoqkQtTB66 address=80.248.64.198,app=cpaneld,creator=cndhtogo,method=handle_form_login,path=loadsession:cndhtogo:XJE67EAB8ezqVP7o,possessed=1,possessor=root


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cndhtogo@cndh-togo.org [06/26/2026:08:40:18 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cndhtogo@cndh-togo.org


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.195.34.60
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-40.72.195.34.60||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.222.237.251
country_id: 1814991
description:
54.222.237.251 - - [26/Jun/2026:08:40:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662060&pdata=https%253A%252F%252Fwellcity.tg%252Fvilla.png&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782463250 HTTP/2.0" 302 0 wellcity.tg "https://wellcity.tg/villa.png" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.6519.1123 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.222.237.251


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.32.198.12
country_id: 3686110
description:
[2026-06-26 08:42:05 +0000] info [cpaneld] 179.32.198.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.99.139
country_id: 1733045
description:
[2026-06-26 08:42:12 +0000] info [cpaneld] 113.211.99.139 - confortis "GET /login/?login_only=1&user=confortis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.51.2.126
country_id: 1210997
description:
[2026-06-26 08:42:25 +0000] info [cpaneld] 103.51.2.126 - confort "GET /login/?login_only=1&user=confort&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confort (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.99.120
country_id: 290557
description:
[2026-06-26 08:42:30 +0000] info [cpaneld] 92.99.99.120 - confo "GET /login/?login_only=1&user=confo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.117.14.190
country_id: 3865483
description:
[2026-06-26 08:42:34 +0000] info [cpaneld] 138.117.14.190 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.124.251.45
country_id: 1210997
description:
[2026-06-26 08:42:39 +0000] info [cpaneld] 103.124.251.45 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.26.169.60
country_id: 3686110
description:
[2026-06-26 08:42:41 +0000] info [cpaneld] 190.26.169.60 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:46:46 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:46:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19648: 535 Incorrect authentication data (set_id=testar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:46:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58262: 535 Incorrect authentication data (set_id=qmails@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:47:24 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:47:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34568: 535 Incorrect authentication data (set_id=aavila@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.106.141.180
country_id: 102358
description:
[2026-06-26 08:47:40 +0000] info [cpaneld] 37.106.141.180 - anam "GET /login/?login_only=1&user=anam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.71.163.208
country_id: 2017370
description:
[2026-06-26 08:47:42 +0000] info [cpaneld] 178.71.163.208 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:47:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60396: 535 Incorrect authentication data (set_id=ogawa@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.138.54.7
country_id: 294640
description:
[2026-06-26 08:47:31 +0000] info [cpaneld] 89.138.54.7 - anamek "GET /login/?login_only=1&user=anamek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.111.164
country_id: 2017370
description:
[2026-06-26 08:47:34 +0000] info [cpaneld] 146.158.111.164 - anamektg "GET /login/?login_only=1&user=anamektg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamektg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.123.208.211
country_id: 3437598
description:
[2026-06-26 08:47:37 +0000] info [cpaneld] 181.123.208.211 - aname "GET /login/?login_only=1&user=aname&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aname (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.188.62.58
country_id: 6252001
description:
54.188.62.58 - - [26/Jun/2026:08:47:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985836&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782463659 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=newupld/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.196 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.188.62.58


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.46
country_id: 1880251
description:
43.173.181.46 - - [26/Jun/2026:08:47:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396776&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fdeveloppement%25252Ftogo-le-pnud-offre-un-vehicule-dune-valeur-de-17-millions-f-cfa-la-cndh%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782463667 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fdeveloppement%2Ftogo-le-pnud-offre-un-vehicule-dune-valeur-de-17-millions-f-cfa-la-cndh%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.46


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:48:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29454: 535 Incorrect authentication data (set_id=ftp14@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:48:24 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:48:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5454: 535 Incorrect authentication data (set_id=sadhbh@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.221.188
country_id: 2363686
description:
[2026-06-26 08:48:45 +0000] info [cpaneld] 102.64.221.188 - mgvybwur "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.215.239
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:213.169.215.239||TA:213.169.215.239||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:49:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22452: 535 Incorrect authentication data (set_id=wenhua@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:49:22 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:49:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53462: 535 Incorrect authentication data (set_id=sqi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.86.211.109
country_id: 690791
description:
Jun 26 08:49:40 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.86.211.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.130.246
country_id: 690791
description:
Jun 26 08:49:45 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:49:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5502: 535 Incorrect authentication data (set_id=lbishop@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:50:25 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:50:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29984: 535 Incorrect authentication data (set_id=usman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:50:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3414: 535 Incorrect authentication data (set_id=portugal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:51:24 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:51:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:6334: 535 Incorrect authentication data (set_id=db5@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:51:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:57900: 535 Incorrect authentication data (set_id=abs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:52:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37726: 535 Incorrect authentication data (set_id=ntop@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:52:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23232: 535 Incorrect authentication data (set_id=joel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:52:20 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.221.188
country_id: 2363686
description:
[2026-06-26 08:52:35 +0000] info [cpaneld] 102.64.221.188 NEW mgvybwur:vQvDbEF2uRnsK53J address=102.64.221.188,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.170.247
country_id: 1880251
description:
2026-06-26 08:52:15 dovecot_plain authenticator failed for H=yplim.net (v8k7wr6vz8b8gno50ccg1vf) [165.232.170.247]:51892: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:53:13 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:53:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64034: 535 Incorrect authentication data (set_id=sst@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:53:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49602: 535 Incorrect authentication data (set_id=aissec@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:53:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35218: 535 Incorrect authentication data (set_id=emailaddress@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:54:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40358: 535 Incorrect authentication data (set_id=pic2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25610: 535 Incorrect authentication data (set_id=entinux@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
country_id: 1269750
description:
2026-06-26 08:54:39 dovecot_login authenticator failed for H=(nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:35562: 535 Incorrect authentication data (set_id=billing@arse.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9fe42f47a612c3bff720033f306a910d87e1b334||Title:dxnuja00nlcnt9lp5||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:54:18 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:55:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49776: 535 Incorrect authentication data (set_id=ys@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.212.51.119
country_id: 630336
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/09/20190916_092512.jpg 1500w, http:/togodailynews.tg/wp-content/uploads/2019/09/20190916_092512-300x216.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2019/09/20190916_092512-768x553.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2019/09/20190916_092512-1024x737.jpg 1024w HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.220.216
country_id: 6252001
description:
[2026-06-26 08:55:32 +0000] info [whostmgrd] 172.56.220.216 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.59.157.44
country_id: 6252001
description:
[2026-06-26 08:56:03 +0000] info [whostmgrd] 2.59.157.44 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:55:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5716: 535 Incorrect authentication data (set_id=jomama@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:55:20 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:56:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32710: 535 Incorrect authentication data (set_id=licensing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:56:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4154: 535 Incorrect authentication data (set_id=trial@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 08:56:11 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:57:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63528: 535 Incorrect authentication data (set_id=twf@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8312: 535 Incorrect authentication data (set_id=vth@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:57:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59398: 535 Incorrect authentication data (set_id=twf@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:58:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39786: 535 Incorrect authentication data (set_id=nitin@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.242.114.128
country_id: 6251999
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:196.242.114.128||TA:196.242.114.128||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:58:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48406: 535 Incorrect authentication data (set_id=rachael@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ecbaf1dc55e6f7632e375975c33ec5a19eb0a8b2||Title:5v0f9ewa6xbtjd||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 08:59:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64376: 535 Incorrect authentication data (set_id=automation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 08:59:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:38206: 535 Incorrect authentication data (set_id=doug@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:164b12763d18161dd03b5764c03caf6876920785||Title:qsvg0jc1x10uw1jd||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:01:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16054: 535 Incorrect authentication data (set_id=cxh@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:00:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40058: 535 Incorrect authentication data (set_id=gabriel@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:00:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28830: 535 Incorrect authentication data (set_id=ite@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:01:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49254: 535 Incorrect authentication data (set_id=cxh@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.17.25
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/09/divers_leroy_060416-1024x425.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2019/09/divers_leroy_060416-1024x425-300x125.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2019/09/divers_leroy_060416-1024x425-768x319.jpg 768w HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:59f02cd23cfa0aa8134cba3b0d89ac474622dcf4||Title:dn1yylnp2am1b0c||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:01:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9104: 535 Incorrect authentication data (set_id=parfum@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.164.150.16
country_id: 3865483
description:
[2026-06-26 09:02:19 +0000] info [cpaneld] 181.164.150.16 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.200.236.38
country_id: 3625428
description:
[2026-06-26 09:02:22 +0000] info [cpaneld] 154.200.236.38 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.0.23.164
country_id: 2921044
description:
[2026-06-26 09:02:25 +0000] info [cpaneld] 77.0.23.164 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:02:30 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:02:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49850: 535 Incorrect authentication data (set_id=odn@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6dc41982ae5f24968abdc842de2c84a7f26c66ec||Title:o9ntfjh8cog3epk||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.223.154
country_id: 3658394
description:
[2026-06-26 09:02:35 +0000] info [cpaneld] 177.234.223.154 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.221.206.111
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:89.221.206.111||TA:89.221.206.111||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.139.152.172
country_id: 1282988
description:
[2026-06-26 09:02:28 +0000] info [cpaneld] 103.139.152.172 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.40.145.30
country_id: 2017370
description:
[2026-06-26 09:02:31 +0000] info [cpaneld] 31.40.145.30 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.255.138.156
country_id: 1643084
description:
[2026-06-26 09:02:38 +0000] info [cpaneld] 101.255.138.156 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.194.249
country_id: 2542007
description:
[2026-06-26 09:02:15 +0000] info [cpaneld] 41.141.194.249 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.184.48.89
country_id: 2017370
description:
[2026-06-26 09:02:40 +0000] info [cpaneld] 109.184.48.89 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:02:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32236: 535 Incorrect authentication data (set_id=fabioc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:03:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62676: 535 Incorrect authentication data (set_id=rajeev@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:03:21 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:03:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8292: 535 Incorrect authentication data (set_id=apteka@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:04:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43038: 535 Incorrect authentication data (set_id=casa@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:04:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24980: 535 Incorrect authentication data (set_id=kopia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:04:18 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:04:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17680: 535 Incorrect authentication data (set_id=kopia@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.8.25.98
country_id: 2750405
description:
45.8.25.98 - - [26/Jun/2026:09:04:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987994&pdata=http%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782464690 HTTP/1.1" 302 0 pnls.tg "http://pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.8.25.98


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83de712551f6fa15b994fb575d937350af95ee68||Title:chphjt5typq4wjxv||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:05:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1060: 535 Incorrect authentication data (set_id=tonzi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:05:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41364: 535 Incorrect authentication data (set_id=ms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:05:40 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:06:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41626: 535 Incorrect authentication data (set_id=asp1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:06:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31790: 535 Incorrect authentication data (set_id=slava@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:06:25 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2d3588aaa6bf1c31d9ebc2377900d6288a6feb4||Title:wjcziffpaxa4lte3qm||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-26 09:07:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56668: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:07:13 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:07:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17772: 535 Incorrect authentication data (set_id=admine@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:18c83091497b414fb6b434fbe86af6111d0d2291||Title:s8mlqxxejm3kaq||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:07:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7986: 535 Incorrect authentication data (set_id=deana@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:08:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48624: 535 Incorrect authentication data (set_id=kobayashi@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.75.224.236
country_id: 99237
description:
[2026-06-26 09:08:57 +0000] info [cpaneld] 185.75.224.236 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.205.157.70
country_id: 3996063
description:
[2026-06-26 09:08:48 +0000] info [cpaneld] 187.205.157.70 - confor "GET /login/?login_only=1&user=confor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confor (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:08:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27040: 535 Incorrect authentication data (set_id=xujing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10362: 535 Incorrect authentication data (set_id=kobayashi@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.116.206.64
country_id: 1562822
description:
[2026-06-26 09:08:27 +0000] info [cpaneld] 42.116.206.64 - confortis "GET /login/?login_only=1&user=confortis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.40.2
country_id: 3437598
description:
[2026-06-26 09:08:53 +0000] info [cpaneld] 181.78.40.2 - confo "GET /login/?login_only=1&user=confo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.232.131.251
country_id: 732800
description:
[2026-06-26 09:09:05 +0000] info [cpaneld] 185.232.131.251 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:08:18 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f3a4553ba4f69e0ab76d123338fd5ee9e86d4609||Title:g9r0ri7y6aa5rc7rl||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.56.134.162
country_id: 2077456
description:
[2026-06-26 09:08:39 +0000] info [cpaneld] 203.56.134.162 - conforti "GET /login/?login_only=1&user=conforti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conforti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.196.119
country_id: 1512440
description:
[2026-06-26 09:08:23 +0000] info [cpaneld] 144.124.196.119 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:09:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10206: 535 Incorrect authentication data (set_id=pilot1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:09:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1028: 535 Incorrect authentication data (set_id=*.eu-west-1.es@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:86d56e7bba432fb8ffb9f4a3e348c9c238cc2e8f||Title:1rhlnjkhwpcthy1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:09:28 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.141.221
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:107.175.141.221||TA:107.175.141.221||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:10:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19216: 535 Incorrect authentication data (set_id=fileext@ns5.netmaster.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.27.60.177
country_id: 6252001
domain: prod.pnls.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:10:18 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:717c1f84f7930671637e53ffd909a46c7a90249f||Title:tglc60emk94c0wy||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41760: 535 Incorrect authentication data (set_id=sid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:11:15 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:11:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59488: 535 Incorrect authentication data (set_id=cimbom@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.78.137
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1d1a98ce43e09010953ee83dce7b7668c9a05bda||Title:at9utmxafulzr0rt9e||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:11:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44338: 535 Incorrect authentication data (set_id=inventaire@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:11:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2202: 535 Incorrect authentication data (set_id=cimbom@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:12:44 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:12:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42644: 535 Incorrect authentication data (set_id=cases@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:12:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35100: 535 Incorrect authentication data (set_id=weldon123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:13:15 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:13:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18680: 535 Incorrect authentication data (set_id=spamtest@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:13:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15346: 535 Incorrect authentication data (set_id=tarama@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.126.255.24
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/09/WhatsApp-Image-2025-09-08-at-16.54.12.webp 856w, http:/togodailynews.tg/wp-content/uploads/2025/09/WhatsApp-Image-2025-09-08-at-16.54.12-238x300.webp 238w, http:/togodailynews.tg/wp-content/uploads/2025/09/WhatsApp-Image-2025-09-08-at-16.54.12-812x1024.webp 812w, http:/togodailynews.tg/wp-content/uploads/2025/09/WhatsApp-Image-2025-09-08-at-16.54.12-768x969.webp 768w HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:14:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27758: 535 Incorrect authentication data (set_id=angie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:14:16 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:14:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13722: 535 Incorrect authentication data (set_id=hd@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:14:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32296: 535 Incorrect authentication data (set_id=fa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:15:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10196: 535 Incorrect authentication data (set_id=legacy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:15:16 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:15:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54484: 535 Incorrect authentication data (set_id=fa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:16:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45074: 535 Incorrect authentication data (set_id=mail8@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.89.33.181
country_id: 6252001
description:
[2026-06-26 09:16:31 +0000] info [cpaneld] 99.89.33.181 - lepopuli "GET /login/?login_only=1&user=lepopuli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopuli (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.112.138.142
country_id: 3865483
description:
[2026-06-26 09:16:45 +0000] info [cpaneld] 190.112.138.142 - lepo "GET /login/?login_only=1&user=lepo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.233.2.235
country_id: 3469034
description:
[2026-06-26 09:16:55 +0000] info [cpaneld] 45.233.2.235 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:16:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50326: 535 Incorrect authentication data (set_id=kramer@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:16:12 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.45.54
country_id: 3895114
description:
[2026-06-26 09:16:49 +0000] info [cpaneld] 190.114.45.54 - lep "GET /login/?login_only=1&user=lep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.254.10
country_id: 3996063
description:
[2026-06-26 09:16:28 +0000] info [cpaneld] 38.194.254.10 - lepopulistetogotg "GET /login/?login_only=1&user=lepopulistetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.107.228.86
country_id: 1562822
description:
[2026-06-26 09:16:39 +0000] info [cpaneld] 116.107.228.86 - lepopu "GET /login/?login_only=1&user=lepopu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.46.178
country_id: 2635167
description:
85.203.46.178 - - [26/Jun/2026:09:17:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792110&pdata=http%253A%252F%252Fpnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782465460 HTTP/1.1" 302 0 pnls.tg "http://pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.46.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:17:11 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:17:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1962: 535 Incorrect authentication data (set_id=vtcsun@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.251.69.9
country_id: 953987
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/06/Avis-dappel-public-\xc3\xa0-candidatures-pour-projet-pilote-de-construction-de-centrales-\xc3\xa9lectriques-\xc3\xa0-base-de-la-biomasse-des-d\xc3\xa9chets-municipaux-et-du-so.pdf HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:17:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25096: 535 Incorrect authentication data (set_id=clara@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.78.210
country_id: 3865483
description:
[2026-06-26 09:19:10 +0000] info [cpaneld] 181.209.78.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:18:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42464: 535 Incorrect authentication data (set_id=mcafee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:18:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36870: 535 Incorrect authentication data (set_id=smtpauth@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:18:15 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11220: 535 Incorrect authentication data (set_id=mcafee@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.37.100.23
country_id: 3865483
description:
[2026-06-26 09:19:33 +0000] info [cpaneld] 179.37.100.23 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.127.129.86
country_id: 3469034
description:
[2026-06-26 09:19:40 +0000] info [cpaneld] 179.127.129.86 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.49.69.157
country_id: 1733045
description:
[2026-06-26 09:19:31 +0000] info [cpaneld] 60.49.69.157 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:19:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12542: 535 Incorrect authentication data (set_id=turtle@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.170.201.247
country_id: 298795
description:
[2026-06-26 09:19:19 +0000] info [cpaneld] 78.170.201.247 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.131.139.209
country_id: 3658394
description:
[2026-06-26 09:19:27 +0000] info [cpaneld] 190.131.139.209 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.102.254.65
country_id: 1562822
description:
[2026-06-26 09:19:14 +0000] info [cpaneld] 116.102.254.65 - cfmi "GET /login/?login_only=1&user=cfmi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:19:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51722: 535 Incorrect authentication data (set_id=svs@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.243.41.249
country_id: 2017370
description:
[2026-06-26 09:19:42 +0000] info [cpaneld] 94.243.41.249 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.112.184
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:45.133.112.184||TA:45.133.112.184||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:19:17 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.253.181
country_id: 3469034
description:
Jun 26 09:19:25 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.253.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 82.156.205.107
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/formation-courte-duree-des-kits-pour-demarrer-les-activites/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.181.130.251
country_id: 2017370
description:
[2026-06-26 09:19:35 +0000] info [cpaneld] 94.181.130.251 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.164.32.151
country_id: 290557
description:
[2026-06-26 09:19:19 +0000] info [cpaneld] 217.164.32.151 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.201.121.140
country_id: 2017370
description:
[2026-06-26 09:19:21 +0000] info [cpaneld] 109.201.121.140 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:20:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14656: 535 Incorrect authentication data (set_id=michael2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:20:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27866: 535 Incorrect authentication data (set_id=sambauser@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 26 09:20:19 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-26 09:21:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11356: 535 Incorrect authentication data (set_id=&\303\251"'(-@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-26 09:21:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4870: 535 Incorrect authentication data (set_id=admin01@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.16
country_id: 6252001
description:
47.251.188.16 - - [26/Jun/2026:09:22:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986394&pdata=https%253A%252F%252Fdagl.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782465771 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [26/Jun/2026:09:22:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725573&pdata=https%253A%252F%252Fwww.snb.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782465773 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [26/Jun/2026:09:23:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052507&pdata=https%253A%252F%252Ftogomedia24.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782465780 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [26/Jun/2026:09:23:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212056&pdata=https%253A%252F%252Flacs1.mairie.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782465793 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [26/Jun/2026:09:23:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725031&pdata=https%253A%252F%252Fmediatopnews.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782465795 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [26/Jun/2026:09:23:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802392&pdata=https%253A%252F%252Fns5mail.netmaster.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782465793 HTTP/2.0" 302 0 ns5mail.netmaster.tg "https://ns5mail.netmaster.tg:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 82.96.168.99
country_id: 3017382
description:
[2026-06-26 09:27:48 +0000] info [cpaneld] 82.96.168.99 NEW vodvpozo:cBLPm6HgXNxOEVEg address=82.96.168.99,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:vodvpozo:o_YW8TanJKIU6kTo:create_user_session,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - b.blaodekissi@ese2i.tg [06/26/2026:09:28:54 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: b.blaodekissi@ese2i.tg


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - j.pahounake@ese2i.tg [06/26/2026:09:30:03 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: j.pahounake@ese2i.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.66.105.27
country_id: 2661886
description:
[2026-06-26 09:29:37 +0000] info [cpaneld] 78.66.105.27 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.53.133.6
country_id: 3469034
description:
[2026-06-26 09:29:43 +0000] info [cpaneld] 177.53.133.6 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.80.185
country_id: 1512440
description:
[2026-06-26 09:29:29 +0000] info [cpaneld] 84.54.80.185 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.157.66.81
country_id: 2464461
description:
[2026-06-26 09:29:35 +0000] info [cpaneld] 102.157.66.81 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.88.128.12
country_id: 298795
description:
[2026-06-26 09:29:40 +0000] info [cpaneld] 176.88.128.12 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.110.107
country_id: 1282988
description:
[2026-06-26 09:29:27 +0000] info [cpaneld] 27.34.110.107 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.130.220
country_id: 3895114
description:
[2026-06-26 09:29:33 +0000] info [cpaneld] 181.42.130.220 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [26/Jun/2026:09:32:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855280&pdata=http%253A%252F%252Fwww.boutique.cafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782466325 HTTP/1.1" 302 0 www.boutique.cafe.tg "http://www.boutique.cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/26/2026:09:33:43 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.106.216.123
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:23.106.216.123||TA:23.106.216.123||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 106.213.80.209
country_id: 1269750
description:
106.213.80.209 - - [26/Jun/2026:09:34:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169385&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782466485 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.4049.1727 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:106.213.80.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.174.124.128
country_id: 298795
description:
[2026-06-26 09:36:08 +0000] info [cpaneld] 195.174.124.128 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.3.171
country_id: 3469034
description:
[2026-06-26 09:36:05 +0000] info [cpaneld] 45.228.3.171 - vitrinenews "GET /login/?login_only=1&user=vitrinenews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.246.138
country_id: 3625428
description:
[2026-06-26 09:36:28 +0000] info [cpaneld] 190.114.246.138 - vit "GET /login/?login_only=1&user=vit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.233.101
country_id: 1733045
description:
[2026-06-26 09:36:14 +0000] info [cpaneld] 180.75.233.101 - vitrine "GET /login/?login_only=1&user=vitrine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.29.147.134
country_id: 3469034
description:
[2026-06-26 09:36:19 +0000] info [cpaneld] 189.29.147.134 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.48.213.70
country_id: 6252001
description:
[2026-06-26 09:36:25 +0000] info [cpaneld] 45.48.213.70 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 175.44.42.252
country_id: 1814991
domain: hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/97.0.4691.0 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.119.79.26
country_id: 3996063
description:
[2026-06-26 09:40:07 +0000] info [cpaneld] 201.119.79.26 - cogerisqtg "GET /login/?login_only=1&user=cogerisqtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisqtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.130.223.39
country_id: 390903
description:
[2026-06-26 09:40:10 +0000] info [cpaneld] 79.130.223.39 - cogeris "GET /login/?login_only=1&user=cogeris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeris (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.206.230.148
country_id: 1210997
description:
[2026-06-26 09:40:21 +0000] info [cpaneld] 103.206.230.148 - coge "GET /login/?login_only=1&user=coge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user coge (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.174.227
country_id: 1733045
description:
180.74.174.227 - - [26/Jun/2026:09:40:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198676&pdata=https%253A%252F%252Fcpanel.marketplace.netmaster.tg%252F%253Flocale%253Dnb&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782466850 HTTP/2.0" 302 0 cpanel.marketplace.netmaster.tg "https://cpanel.marketplace.netmaster.tg/?locale=nb" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.174.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.232.107.5
country_id: 3469034
description:
[2026-06-26 09:40:25 +0000] info [cpaneld] 186.232.107.5 - cog "GET /login/?login_only=1&user=cog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cog (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.3.3
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/8 HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.173
country_id: 1880251
description:
47.128.121.173 - - [26/Jun/2026:09:42:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10079129&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fconference-annuelle-du-coaching%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782466956 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/conference-annuelle-du-coaching/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.173


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.47
country_id: 1880251
description:
43.172.197.47 - - [26/Jun/2026:09:46:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988969&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F1667&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782467206 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/1667" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.47


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.176.74.79
country_id: 3865483
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.confortis.tg/NosPublications HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.204.43
country_id: 1210997
description:
[2026-06-26 09:47:36 +0000] info [cpaneld] 103.190.204.43 - belali "GET /login/?login_only=1&user=belali&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belali (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.8.119.43
country_id: 2562770
description:
[2026-06-26 09:47:42 +0000] info [cpaneld] 141.8.119.43 - belal "GET /login/?login_only=1&user=belal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.191.49.50
country_id: 3996063
description:
[2026-06-26 09:47:45 +0000] info [cpaneld] 187.191.49.50 - bela "GET /login/?login_only=1&user=bela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.132.92
country_id: 3996063
description:
[2026-06-26 09:47:47 +0000] info [cpaneld] 187.190.132.92 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.136.151.42
country_id: 99237
description:
[2026-06-26 09:47:50 +0000] info [cpaneld] 185.136.151.42 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.117.114.65
country_id: 3865483
description:
[2026-06-26 09:47:32 +0000] info [cpaneld] 138.117.114.65 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.205.19.115
country_id: 6251999
description:
[2026-06-26 09:47:40 +0000] info [cpaneld] 104.205.19.115 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.213
country_id: 6252001
description:
[2026-06-26 09:50:57 +0000] info [cpaneld] 45.38.16.213 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-06-26 09:51:37 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:39156: 535 Incorrect authentication data (set_id=office@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 50.72.154.252
country_id: 6251999
description:
50.72.154.252 - - [26/Jun/2026:09:51:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921415&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F02%252F19%252Fbest-ontario-on-line-casinos-2025-actual-money-gambling-sites%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782467474 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/02/19/best-ontario-on-line-casinos-2025-actual-money-gambling-sites/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:50.72.154.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.39.128.169
country_id: 1814991
description:
Jun 26 09:54:04 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.39.128.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.169
country_id: 1814991
description:
2026-06-26 09:54:06 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [27.39.128.169]:41834: 535 Incorrect authentication data (set_id=divport1@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.200.197.58
country_id: 6252001
description:
[2026-06-26 09:55:27 +0000] info [cpaneld] 44.200.197.58 - benoit21112@gmail.com "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.39.128.169
country_id: 1814991
description:
Jun 26 09:55:34 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.39.128.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.169
country_id: 1814991
description:
2026-06-26 09:55:36 dovecot_login authenticator failed for H=(90-228-229-182-no600.tbcn.telia.com) [27.39.128.169]:60994: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@cloud-et-racks.tg [06/26/2026:09:58:10 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@cloud-et-racks.tg


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.72.53
country_id: 1512440
description:
2026-06-26 09:58:06 H=([84.54.72.53]) [84.54.72.53]:30827 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.177.114.160
country_id: 6252001
description:
[2026-06-26 09:57:45 +0000] info [cpaneld] 64.177.114.160 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.26.153
country_id: 3865483
description:
[2026-06-26 09:58:44 +0000] info [cpaneld] 186.158.26.153 - ekeasarlcom "GET /login/?login_only=1&user=ekeasarlcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarlcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.159.103.90
country_id: 1733045
description:
[2026-06-26 09:58:54 +0000] info [cpaneld] 110.159.103.90 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.205.147
country_id: 2542007
description:
[2026-06-26 09:58:57 +0000] info [cpaneld] 105.77.205.147 - ekeas "GET /login/?login_only=1&user=ekeas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.250.25.67
country_id: 2661886
description:
[2026-06-26 09:58:40 +0000] info [cpaneld] 83.250.25.67 - ekeasarl "GET /login/?login_only=1&user=ekeasarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.19.27.121
country_id: 3469034
description:
[2026-06-26 09:59:01 +0000] info [cpaneld] 187.19.27.121 - ekea "GET /login/?login_only=1&user=ekea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekea (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.210.204
country_id: 6252001
description:
2026-06-26 09:59:58 dovecot_login authenticator failed for H=160-3-210-204.cpe.sparklight.net ([94.16.17.140]) [160.3.210.204]:54608: 535 Incorrect authentication data (set_id=dkabrane@confortis.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.68
country_id: 3017382
description:
[2026-06-26 09:59:52 +0000] info [cpaneld] 5.231.64.68 NEW wcnyaruu:t_UMaVqzIeqNxpsv address=5.231.64.68,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.151
country_id: 1880251
description:
43.173.175.151 - - [26/Jun/2026:09:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039384&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F25019&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782467990 HTTP/1.1" 404 561 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/25019" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.151


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/26/2026:10:01:12 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.28.18
country_id: 2363686
description:
[2026-06-26 10:02:47 +0000] info [webmaild] 196.171.28.18 - fagbemedji@togointerim.net "GET /cpsess9147676857/3rdparty/roundcube/?_task=mail&_action=keep-alive&_remote=1&_unlock=0&_=1782460664576 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.46.177] != Current IP Address [196.171.28.18]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@case-afrique.tg [06/26/2026:10:04:40 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@case-afrique.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.36.205.235
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/visite-du-ministre-allemand-de-la-cooperation-economique-et-du-developpement HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.223.229
country_id: 2363686
description:
[2026-06-26 10:04:21 +0000] info [cpaneld] 196.168.223.229 NEW prbthzuj:wfGfn5EuZpGRf91D address=196.168.223.229,app=cpaneld,creator=prbthzuj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.8.160.129
country_id: 6252001
description:
[2026-06-26 10:05:17 +0000] info [cpaneld] 76.8.160.129 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.33.170.111
country_id: 6252001
description:
[2026-06-26 10:05:25 +0000] info [cpaneld] 136.33.170.111 - cfm "GET /login/?login_only=1&user=cfm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfm (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-26 10:05:52 +0000] info [cpaneld] 154.70.80.74 NEW cloudetracks:xJGggL5jpoE_xCC3 address=154.70.80.74,app=cpaneld,creator=cloudetracks,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.197.97.71
country_id: 6252001
description:
[2026-06-26 10:05:20 +0000] info [cpaneld] 68.197.97.71 - cfmi "GET /login/?login_only=1&user=cfmi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.33.136.225
country_id: 6252001
description:
[2026-06-26 10:05:28 +0000] info [cpaneld] 100.33.136.225 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@cloud-et-racks.tg [06/26/2026:10:08:08 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@cloud-et-racks.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.133.120
country_id: 1269750
description:
Jun 26 10:07:20 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.133.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.34.1.198
country_id: 1522867
description:
[2026-06-26 10:09:40 +0000] info [cpaneld] 5.34.1.198 - soeurn "GET /login/?login_only=1&user=soeurn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.180.24.48
country_id: 298795
description:
[2026-06-26 10:09:44 +0000] info [cpaneld] 78.180.24.48 - soeur "GET /login/?login_only=1&user=soeur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.187.61.38
country_id: 3996063
description:
[2026-06-26 10:09:50 +0000] info [cpaneld] 189.187.61.38 - soeu "GET /login/?login_only=1&user=soeu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.165.96.90
country_id: 3686110
description:
[2026-06-26 10:09:23 +0000] info [cpaneld] 190.165.96.90 - soeurndetogo "GET /login/?login_only=1&user=soeurndetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.98.118.45
country_id: 783754
description:
[2026-06-26 10:09:36 +0000] info [cpaneld] 79.98.118.45 - soeurnd "GET /login/?login_only=1&user=soeurnd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.127.223
country_id: 3624060
description:
[2026-06-26 10:09:33 +0000] info [cpaneld] 153.67.127.223 - soeurnde "GET /login/?login_only=1&user=soeurnde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnde (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.60.34.214
country_id: 1880251
description:
[2026-06-26 10:09:54 +0000] info [cpaneld] 42.60.34.214 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [26/Jun/2026:10:10:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868182&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782468644 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.65.192.157
country_id: 2542007
description:
[2026-06-26 10:15:25 +0000] info [cpaneld] 196.65.192.157 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.109.84.188
country_id: 3469034
description:
[2026-06-26 10:15:37 +0000] info [cpaneld] 179.109.84.188 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.22.121.194
country_id: 953987
description:
[2026-06-26 10:15:42 +0000] info [cpaneld] 102.22.121.194 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.135.169.131
country_id: 192950
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/special-journee-de-de-don-de-sang HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.211.117
country_id: 192950
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/jeu-capsules-consommateurs-remise-lots-1 HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.170.96
country_id: 2017370
description:
[2026-06-26 10:15:31 +0000] info [cpaneld] 109.252.170.96 - cenitg "GET /login/?login_only=1&user=cenitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cenitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.52.50
country_id: 2635167
description:
[2026-06-26 10:16:49 +0000] info [cpaneld] 104.207.52.50 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.182.145
country_id: 2921044
description:
[2026-06-26 10:16:48 +0000] info [cpaneld] 209.50.182.145 - dpmvthqq "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dpmvthqq (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.207.52.50
country_id: 2635167
description:
104.207.52.50 - - [26/Jun/2026:10:16:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855624&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782469007 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.207.52.50


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-26 10:18:07 H=([77.83.39.59]) [77.83.39.59]:52441 F=<advising.service@advising.hsbc.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.245.217.108
country_id: 2017370
description:
[2026-06-26 10:19:04 +0000] info [cpaneld] 77.245.217.108 - lepop "GET /login/?login_only=1&user=lepop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.150.166.241
country_id: 1210997
description:
[2026-06-26 10:18:57 +0000] info [cpaneld] 103.150.166.241 - lepopul "GET /login/?login_only=1&user=lepopul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.208.86.248
country_id: 3469034
description:
[2026-06-26 10:19:01 +0000] info [cpaneld] 186.208.86.248 - lepopu "GET /login/?login_only=1&user=lepopu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.106.149.206
country_id: 2589581
description:
[2026-06-26 10:18:45 +0000] info [cpaneld] 105.106.149.206 - lepopulistetogo "GET /login/?login_only=1&user=lepopulistetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.146.81.158
country_id: 298795
description:
[2026-06-26 10:19:15 +0000] info [cpaneld] 159.146.81.158 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.85.54
country_id: 3895114
description:
[2026-06-26 10:19:12 +0000] info [cpaneld] 186.189.85.54 - lep "GET /login/?login_only=1&user=lep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-26 10:21:42 +0000] info [cpaneld] 102.54.238.57 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.101.226.79
country_id: 298795
description:
[2026-06-26 10:22:08 +0000] info [webmaild] 85.101.226.79 - b.blaodekissi@ese2i.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.159.23.203
country_id: 6252001
domain: snb.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-22.45.159.23.203||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.126.111.218
country_id: 6252001
domain: snb.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-22.176.126.111.218||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-26 10:22:15 +0000] info [cpaneld] 102.54.238.57 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 178.20.212.157
country_id: 241170
domain: snb.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-23.178.20.212.157||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-06-26 10:23:11 dovecot_login authenticator failed for H=([112.116.48.163]) [173.18.106.54]:36162: 535 Incorrect authentication data (set_id=dkponor@otr.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.99.25.77
country_id: 6252001
domain: snb.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-23.194.99.25.77||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3387e147f144319866ad9608c3596001f609a8af||Title:qbdx5z08huhu2c||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.39.235.247
country_id: 953987
description:
[2026-06-26 10:24:33 +0000] info [cpaneld] 196.39.235.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.213.178.196
country_id: 2510769
description:
[2026-06-26 10:24:41 +0000] info [cpaneld] 82.213.178.196 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.9.211.97
country_id: 3865483
description:
[2026-06-26 10:24:47 +0000] info [cpaneld] 181.9.211.97 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.67.54.205
country_id: 1168579
description:
[2026-06-26 10:25:12 +0000] info [cpaneld] 103.67.54.205 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:398956384e1dd657a1c15d13e7ae87aae0641da7||Title:hbnisg17ey2vtehfi||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e9f68dbe87f580f2eebe7c8a1b6843b7ca7ec8b||Title:0qyu4ye0v93qau28||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b195f340fccb358bfaf237067ea1dc2085f1d62||Title:nnleo7hj8rfvl6m||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:86e606b7633b3f99f15c3842f2246d14f09309ac||Title:6841a58a6dqq7o1rqm||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.102.223.185
country_id: 660013
domain: www.djama.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:172.102.223.185||TA:172.102.223.185||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb811fda551321903a0d40a73ab6ee5b58af02cd||Title:1cx9fqywgnffbieq0||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b806c8cebbfc66f9fc0d258d38b5b0c05da33e5||Title:xchhxtxjje1h6b||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:91a1dede7a4c99d2e75c61faea5acf981a1e21be||Title:50uy37u3mjm9ctra||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a29482d9eecec391cb6947cc26f6b9db78dda499||Title:8qqukbyxkrw42kg3s||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2fc275789a9831c675df66fe36077187252e58d||Title:m65rpislfhr43k||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b60dc0eeb20301b8012ed060ad4895baeea65ebf||Title:6wz078cd5l3bho7etk||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 81.70.43.117
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/le-ghana-saisit-lonu-pour-des-reparations-liees-a-lesclavage/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.108
country_id: 1269750
description:
Jun 26 10:34:41 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.181.61.191
country_id: 6252001
description:
[2026-06-26 10:35:42 +0000] info [cpaneld] 24.181.61.191 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.248.184.127
country_id: 6252001
description:
[2026-06-26 10:35:47 +0000] info [cpaneld] 172.248.184.127 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.227.67
country_id: 6252001
description:
[2026-06-26 10:35:53 +0000] info [cpaneld] 96.245.227.67 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.108.175.83
country_id: 6252001
description:
[2026-06-26 10:35:38 +0000] info [cpaneld] 174.108.175.83 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.52.226.65
country_id: 6252001
description:
[2026-06-26 10:35:50 +0000] info [cpaneld] 64.52.226.65 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.88.83.195
country_id: 6252001
description:
[2026-06-26 10:36:01 +0000] info [cpaneld] 138.88.83.195 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.1.23
country_id: 6252001
description:
[2026-06-26 10:35:32 +0000] info [cpaneld] 172.58.1.23 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.254.62.230
country_id: 6252001
description:
[2026-06-26 10:35:57 +0000] info [cpaneld] 75.254.62.230 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.44.192
country_id: 6252001
description:
[2026-06-26 10:35:35 +0000] info [cpaneld] 71.187.44.192 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e28ca69d7b7a8fd28d07a6739ec88942dc532e8c||Title:tz4ioj896a32agleci||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6a554b070bf48f7d719e2b2807646351b8cab51||Title:ooqilnh030womllad||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26530307da96074a896b04382f43f2b83cb34299||Title:g8nfqkjzehiibahi9||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.244.5
country_id: 3508796
description:
[2026-06-26 10:38:49 +0000] info [cpaneld] 38.44.244.5 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.102.198.53
country_id: 3469034
description:
[2026-06-26 10:39:03 +0000] info [cpaneld] 187.102.198.53 - lv "GET /login/?login_only=1&user=lv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.176.27.28
country_id: 3865483
description:
[2026-06-26 10:38:11 +0000] info [cpaneld] 190.176.27.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.18.60.15
country_id: 2635167
description:
[2026-06-26 10:38:17 +0000] info [cpaneld] 86.18.60.15 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.17.0.133
country_id: 3865483
description:
[2026-06-26 10:38:53 +0000] info [cpaneld] 38.17.0.133 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.178.175.94
country_id: 2464461
description:
[2026-06-26 10:38:25 +0000] info [cpaneld] 196.178.175.94 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.241.55.181
country_id: 2921044
description:
[2026-06-26 10:38:28 +0000] info [cpaneld] 2.241.55.181 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.96.86.168
country_id: 798549
description:
[2026-06-26 10:38:42 +0000] info [cpaneld] 78.96.86.168 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1fb864bc6d9cbd1ac67e9a1f1438e35a3f60efd3||Title:tggjqa2htofbgfsr1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 145.255.22.164
country_id: 2017370
description:
[2026-06-26 10:38:22 +0000] info [cpaneld] 145.255.22.164 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:235622a609b31281331419291cbcba0f7aff04de||Title:y41o97mmw38tunsi||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f3ae2f8be451fbf5105fa26eedd84f53b8a7c8ef||Title:1nmh9v1vktuo5nbn50||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd64a44d80c458e4cf3f38cbe27358090c7cfed8||Title:xlraxgmb0h1l5q9i||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.130.10.193
country_id: 2017370
description:
[2026-06-26 10:40:55 +0000] info [cpaneld] 31.130.10.193 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-26 10:41:03 +0000] info [cpaneld] 102.54.238.57 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:177a0ed0b37a240e6976feb8f1dfac81e114892b||Title:vi0xln9tm2un45b4g||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.209.213.20
country_id: 2921044
description:
[2026-06-26 10:40:43 +0000] info [cpaneld] 92.209.213.20 - tilitulab "GET /login/?login_only=1&user=tilitulab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.228.82.163
country_id: 2017370
description:
[2026-06-26 10:40:51 +0000] info [cpaneld] 5.228.82.163 - tilitula "GET /login/?login_only=1&user=tilitula&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitula (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.127.231.112
country_id: 2510769
description:
86.127.231.112 - - [26/Jun/2026:10:40:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973590&pdata=https%253A%252F%252Fwebmail.sightofgood.free.netmaster.tg%252F%253Flocale%253Dhu&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782470413 HTTP/2.0" 302 0 webmail.sightofgood.free.netmaster.tg "https://webmail.sightofgood.free.netmaster.tg/?locale=hu" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.127.231.112


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.112.122.9
country_id: 1527747
description:
[2026-06-26 10:40:47 +0000] info [cpaneld] 212.112.122.9 - tilitulabtg "GET /login/?login_only=1&user=tilitulabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.138.72.19
country_id: 2017370
description:
[2026-06-26 10:41:02 +0000] info [cpaneld] 46.138.72.19 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.51.23.245
country_id: 3469034
description:
[2026-06-26 10:41:07 +0000] info [cpaneld] 189.51.23.245 - tili "GET /login/?login_only=1&user=tili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tili (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:efb1ee5a42e237fe6a05fb49a1744d44443ca0a7||Title:kpnvfgavs0jefu1a||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.112.90
country_id: 1512440
description:
[2026-06-26 10:41:18 +0000] info [cpaneld] 213.230.112.90 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.167.169.45
country_id: 3508796
description:
[2026-06-26 10:42:10 +0000] info [cpaneld] 190.167.169.45 - togofarmtg "GET /login/?login_only=1&user=togofarmtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarmtg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf68e664622cd644f73e952fd7e36f79971852ac||Title:9wl3fixhmwz2n4r||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.11.16
country_id: 3469034
description:
[2026-06-26 10:42:07 +0000] info [cpaneld] 143.137.11.16 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.60.205.86
country_id: 2264397
description:
[2026-06-26 10:42:13 +0000] info [cpaneld] 94.60.205.86 - togofar "GET /login/?login_only=1&user=togofar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.138.132.175
country_id: 1733045
description:
[2026-06-26 10:42:17 +0000] info [cpaneld] 175.138.132.175 - togofa "GET /login/?login_only=1&user=togofa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.211.124.110
country_id: 1522867
description:
[2026-06-26 10:42:36 +0000] info [cpaneld] 213.211.124.110 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e7bf047b82512be3ffc584a552b9893457619382||Title:dnk87zqwg6bj3f23wn||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.116
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e37b633fc7ed19e968d72d630f9eed0a0b5bfa26||Title:vqd6s6z8imlx47||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f69d34fbe10e94f1f056cfed794d013fa976d7d||Title:zq0zs3l08lmum07||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-26 10:44:24 +0000] info [cpaneld] 5.230.153.18 NEW cinemafreenetmas:H56ufpHqwdMlOsqB address=5.230.153.18,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.236.73.202
country_id: 3996063
description:
[2026-06-26 10:44:48 +0000] info [cpaneld] 177.236.73.202 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.192.245.96
country_id: 3865483
description:
[2026-06-26 10:45:05 +0000] info [cpaneld] 190.192.245.96 - univers "GET /login/?login_only=1&user=univers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.138.119
country_id: 290557
description:
[2026-06-26 10:44:51 +0000] info [cpaneld] 92.99.138.119 - universcom "GET /login/?login_only=1&user=universcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcom (has_cpuser_file failed)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.151
country_id: 6252001
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.810583893469513.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.77.166.229
country_id: 3469034
description:
[2026-06-26 10:44:56 +0000] info [cpaneld] 201.77.166.229 - universcomtg "GET /login/?login_only=1&user=universcomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universcomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.45.249.9
country_id: 3996063
description:
[2026-06-26 10:44:59 +0000] info [cpaneld] 38.45.249.9 - universc "GET /login/?login_only=1&user=universc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universc (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b77b8b5d747a0b8f3a7fec68ad4730e4b4bf112||Title:0zexkee3gdsp09j0||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5e8a9a81e2ebfc17db896d89c49b6381139216a||Title:cozbbr1p7lh8w7||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.151.41
country_id: 294640
description:
[2026-06-26 10:45:22 +0000] info [cpaneld] 79.177.151.41 - uni "GET /login/?login_only=1&user=uni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.219.143.96
country_id: 3469034
description:
[2026-06-26 10:45:26 +0000] info [cpaneld] 186.219.143.96 - un "GET /login/?login_only=1&user=un&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user un (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.11.104
country_id: 3469034
description:
[2026-06-26 10:45:38 +0000] info [cpaneld] 177.124.11.104 - vitrinenews "GET /login/?login_only=1&user=vitrinenews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.70.240.148
country_id: 2542007
description:
[2026-06-26 10:45:51 +0000] info [cpaneld] 196.70.240.148 - vitrine "GET /login/?login_only=1&user=vitrine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.241.219
country_id: 99237
description:
[2026-06-26 10:45:55 +0000] info [cpaneld] 62.201.241.219 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.37.210.235
country_id: 3469034
description:
[2026-06-26 10:46:06 +0000] info [cpaneld] 191.37.210.235 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.71.234
country_id: 1210997
description:
[2026-06-26 10:45:44 +0000] info [cpaneld] 114.130.71.234 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.7.57
country_id: 3865483
description:
[2026-06-26 10:46:01 +0000] info [cpaneld] 153.67.7.57 - vitri "GET /login/?login_only=1&user=vitri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.198.101.212
country_id: 1522867
description:
[2026-06-26 10:45:32 +0000] info [cpaneld] 91.198.101.212 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.10.6.63
country_id: 298795
description:
[2026-06-26 10:45:16 +0000] info [cpaneld] 95.10.6.63 - unive "GET /login/?login_only=1&user=unive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user unive (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49fe091880a01ef1b648e82d9ed27c99df1c19ef||Title:i7qhhbbvt7px5b7gz5||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.159.35.188
country_id: 1880251
domain: cfpj.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/5||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:66ae28c59bc537124f86d34f6fb0267597cf609a||Title:26v2dmvbj4o7hqj2||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-26 10:47:49 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:37778: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a0c71b469a8b7045f493c6a5c9677d0a6a2a1079||Title:hnhrx0g53zoj6nxg||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.190.3
country_id: 6252001
description:
[2026-06-26 10:48:22 +0000] info [cpaneld] 68.224.190.3 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.190.242.215
country_id: 6252001
description:
[2026-06-26 10:48:25 +0000] info [cpaneld] 71.190.242.215 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.98.9.113
country_id: 6252001
description:
[2026-06-26 10:48:27 +0000] info [cpaneld] 68.98.9.113 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.38.130.20
country_id: 6252001
description:
[2026-06-26 10:48:44 +0000] info [cpaneld] 100.38.130.20 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.162.252.55
country_id: 6252001
description:
[2026-06-26 10:48:47 +0000] info [cpaneld] 24.162.252.55 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.214.132
country_id: 6252001
description:
[2026-06-26 10:48:51 +0000] info [cpaneld] 76.136.214.132 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.14.152.207
country_id: 6252001
description:
[2026-06-26 10:48:37 +0000] info [cpaneld] 100.14.152.207 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.212.24
country_id: 6252001
description:
[2026-06-26 10:48:54 +0000] info [cpaneld] 72.80.212.24 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.105.98.68
country_id: 6252001
description:
[2026-06-26 10:48:33 +0000] info [cpaneld] 50.105.98.68 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.228.128.60
country_id: 6252001
description:
[2026-06-26 10:48:41 +0000] info [cpaneld] 75.228.128.60 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.165
country_id: 2363686
description:
2026-06-26 10:50:08 dovecot_login authenticator failed for H=(Yoga) [102.64.145.165]:57534: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6a5fa5e790c8be9c6b45ad25b5cd3dc3d27edb4||Title:t91gatyi9ypzk6m||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fe26be14bedf47c46bd0e7924bb1ea3e4ca9d47||Title:zlf5255w19rmby||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.98
country_id: 3469034
description:
Jun 26 10:50:39 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.175.162.8
country_id: 3865483
description:
[2026-06-26 10:51:18 +0000] info [cpaneld] 45.175.162.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:374f1e63bae04c63e89f1d960cf2474dec81d8e7||Title:lwrp2xv47tr104||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.135.220.35
country_id: 2017370
description:
[2026-06-26 10:51:23 +0000] info [cpaneld] 91.135.220.35 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.22.85
country_id: 1562822
description:
[2026-06-26 10:51:27 +0000] info [cpaneld] 14.191.22.85 - zephyrtg "GET /login/?login_only=1&user=zephyrtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyrtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.108.245
country_id: 2921044
description:
[2026-06-26 10:51:44 +0000] info [cpaneld] 92.208.108.245 - ze "GET /login/?login_only=1&user=ze&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ze (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54617b89c27f51b9fe72d75762b06b42a114217d||Title:4it53cb75e491jczi||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.133.46.63
country_id: 2635167
description:
5.133.46.63 - - [26/Jun/2026:10:53:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078107&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F02%252F18%252Fmeilleurs-casinos-en-trait-fiables-fevrier-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782471184 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/02/18/meilleurs-casinos-en-trait-fiables-fevrier-2025/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.133.46.63


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c4eff167e91d22444e8965f05c443931f9d5151||Title:et71iwacbkzufiw||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b772214e269efdd19fc20392bab598d60fed3229||Title:zua3uuae3igg4on||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:007a32e860c4e3c6f2c879f04e71ede3af9cfa11||Title:ydilts6527qz84qko||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.20.116.206
country_id: 1210997
description:
[2026-06-26 10:55:42 +0000] info [cpaneld] 157.20.116.206 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.73.93
country_id: 1512440
description:
[2026-06-26 10:55:36 +0000] info [cpaneld] 84.54.73.93 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.141.246.3
country_id: 2017370
description:
[2026-06-26 10:55:52 +0000] info [cpaneld] 178.141.246.3 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.249.12.121
country_id: 1668284
description:
[2026-06-26 10:55:48 +0000] info [cpaneld] 111.249.12.121 - itstg "GET /login/?login_only=1&user=itstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user itstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.255.108.79
country_id: 3469034
description:
[2026-06-26 10:56:29 +0000] info [cpaneld] 143.255.108.79 - lesnidsu "GET /login/?login_only=1&user=lesnidsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.22.99.153
country_id: 3895114
description:
[2026-06-26 10:56:33 +0000] info [cpaneld] 190.22.99.153 - lesnids "GET /login/?login_only=1&user=lesnids&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnids (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.145.165
country_id: 2363686
description:
2026-06-26 10:56:42 dovecot_login authenticator failed for H=(Yoga) [102.64.145.165]:64016: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.207.193.190
country_id: 290557
description:
[2026-06-26 10:56:16 +0000] info [cpaneld] 94.207.193.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.86.37.124
country_id: 3469034
description:
[2026-06-26 10:56:25 +0000] info [cpaneld] 177.86.37.124 - lesnidsurbainstg "GET /login/?login_only=1&user=lesnidsurbainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbainstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.219.213.80
country_id: 3469034
description:
[2026-06-26 10:56:49 +0000] info [cpaneld] 186.219.213.80 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a73cb3a9db90aadd7c954f1f27ce0ae28ba8a13||Title:litcl7map6kutu2||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.237.82
country_id: 3469034
description:
[2026-06-26 10:56:21 +0000] info [cpaneld] 170.81.237.82 - lesnidsurbains "GET /login/?login_only=1&user=lesnidsurbains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.211.111.138
country_id: 3996063
description:
[2026-06-26 10:56:42 +0000] info [cpaneld] 187.211.111.138 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.61.212.2
country_id: 1210997
description:
[2026-06-26 10:56:54 +0000] info [cpaneld] 163.61.212.2 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49c670508867e2a869fff72ca3ed76fb5baacb22||Title:ht0egse0cxfz3sdek4||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f772fc2c4251ddc318dbd1ab435bf4d0e7bbbc1||Title:7xs4amp6k6c9vuo||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.38.41
country_id: 3895114
description:
[2026-06-26 10:58:24 +0000] info [cpaneld] 195.86.38.41 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69f71f2e949791868558a8ddc977cdb8487c40da||Title:ny7vevpnho1qig3qv||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.82.117
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cfac22a5f72f9f8845b11cafec95a8ad62288a7f||Title:cpfgmunnbf8qt1dlb8||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 26 11:03:54 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-26 11:06:18 +0000] info [cpaneld] 102.54.238.57 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.19.103.99
country_id: 2077456
description:
[2026-06-26 11:06:42 +0000] info [cpaneld] 120.19.103.99 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.151
country_id: 99237
description:
[2026-06-26 11:06:54 +0000] info [cpaneld] 212.237.121.151 - tilitula "GET /login/?login_only=1&user=tilitula&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitula (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.198.86
country_id: 1733045
description:
[2026-06-26 11:06:59 +0000] info [cpaneld] 115.135.198.86 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.33.141.44
country_id: 2921044
description:
[2026-06-26 11:07:07 +0000] info [cpaneld] 95.33.141.44 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.140.235.25
country_id: 1210997
description:
[2026-06-26 11:07:13 +0000] info [cpaneld] 103.140.235.25 - tili "GET /login/?login_only=1&user=tili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.33.64.44
country_id: 3469034
description:
[2026-06-26 11:07:17 +0000] info [cpaneld] 189.33.64.44 - til "GET /login/?login_only=1&user=til&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user til (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 169.239.183.171
country_id: 953987
description:
2026-06-26 11:07:27 H=([169.239.183.171]) [169.239.183.171]:53117 F=<Noreply@office365.com> rejected RCPT <assistance@dgdn-togo.tg>: No Such User Here


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.142.104.248
country_id: 3625428
description:
[2026-06-26 11:07:22 +0000] info [cpaneld] 190.142.104.248 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.104.155
country_id: 2363686
description:
[2026-06-26 11:09:07 +0000] info [webmaild] 196.168.104.155 - k "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user k (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [06/26/2026:11:09:53 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-26 11:09:30 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:WxPD6XyJhCGFPrhK address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.35.196
country_id: 2215636
description:
[2026-06-26 11:12:11 +0000] info [cpaneld] 102.209.35.196 - fastsolutiontg "GET /login/?login_only=1&user=fastsolutiontg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutiontg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.45.29.79
country_id: 6251999
description:
[2026-06-26 11:12:08 +0000] info [cpaneld] 45.45.29.79 - fastsolution "GET /login/?login_only=1&user=fastsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolution (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-26 11:11:14 +0000] info [webmaild] 196.168.0.186 - kawunyo@wages.tg "POST /cpsess5103355294/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.237.192.31
country_id: 1527747
description:
[2026-06-26 11:12:20 +0000] info [cpaneld] 89.237.192.31 - fastso "GET /login/?login_only=1&user=fastso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.101.154
country_id: 2542007
description:
[2026-06-26 11:12:33 +0000] info [cpaneld] 197.147.101.154 - fas "GET /login/?login_only=1&user=fas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.90.235.171
country_id: 3469034
description:
[2026-06-26 11:12:31 +0000] info [cpaneld] 189.90.235.171 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 194.226.75.82
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 194.226.75.82: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.143.254.82
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.143.254.82: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 194.226.75.83
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 194.226.75.83: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.232.160.50
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 193.232.160.50: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 46.61.210.142
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 46.61.210.142: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.93.192.10
country_id: 298795
description:
91.93.192.10 - - [26/Jun/2026:11:14:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119780&pdata=https%253A%252F%252Fmail.batika.free.netmaster.tg%252Fcgi-bin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782472439 HTTP/2.0" 302 0 mail.batika.free.netmaster.tg "https://mail.batika.free.netmaster.tg/cgi-bin/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.93.192.10


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [06/26/2026:11:15:03 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.223.41.126
country_id: 6252001
description:
[2026-06-26 11:14:33 +0000] info [cpaneld] 66.223.41.126 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.223.196.80
country_id: 6252001
description:
[2026-06-26 11:14:44 +0000] info [cpaneld] 216.223.196.80 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.113.166
country_id: 6252001
description:
[2026-06-26 11:14:50 +0000] info [cpaneld] 174.106.113.166 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.231.190.77
country_id: 6252001
description:
[2026-06-26 11:14:57 +0000] info [cpaneld] 96.231.190.77 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.15.229.119
country_id: 6252001
description:
[2026-06-26 11:14:30 +0000] info [cpaneld] 70.15.229.119 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.205.247.104
country_id: 6252001
description:
[2026-06-26 11:14:36 +0000] info [cpaneld] 97.205.247.104 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.52.236.74
country_id: 6252001
description:
[2026-06-26 11:14:40 +0000] info [cpaneld] 198.52.236.74 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.130.33.24
country_id: 6252001
description:
[2026-06-26 11:14:47 +0000] info [cpaneld] 35.130.33.24 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.76.202
country_id: 6252001
description:
[2026-06-26 11:19:22 +0000] info [cpaneld] 217.181.76.202 - afdim "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [26/Jun/2026:11:19:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684167&pdata=http%253A%252F%252Fsahamtg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782472752 HTTP/1.1" 302 0 sahamtg.com "http://sahamtg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.116.166.210
country_id: 2510769
description:
[2026-06-26 11:23:09 +0000] info [cpaneld] 79.116.166.210 - ekinama "GET /login/?login_only=1&user=ekinama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.240.137
country_id: 290557
description:
[2026-06-26 11:22:59 +0000] info [cpaneld] 92.99.240.137 - ekinamag "GET /login/?login_only=1&user=ekinamag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.53.35.5
country_id: 1733045
description:
[2026-06-26 11:23:05 +0000] info [cpaneld] 60.53.35.5 - ekinamagtg "GET /login/?login_only=1&user=ekinamagtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamagtg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.163
country_id: 1880251
description:
43.172.196.163 - - [26/Jun/2026:11:23:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7521377&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F3024&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782472997 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/3024" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.254.206
country_id: 285570
description:
[2026-06-26 11:23:24 +0000] info [cpaneld] 37.231.254.206 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.145.165
country_id: 1210997
description:
[2026-06-26 11:23:26 +0000] info [cpaneld] 103.55.145.165 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.191.34.5
country_id: 3469034
description:
[2026-06-26 11:23:30 +0000] info [cpaneld] 179.191.34.5 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.225.171.2
country_id: 3469034
description:
[2026-06-26 11:23:39 +0000] info [cpaneld] 45.225.171.2 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.85.43
country_id: 3895114
description:
[2026-06-26 11:23:15 +0000] info [cpaneld] 186.189.85.43 - ekinam "GET /login/?login_only=1&user=ekinam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.5.23
country_id: 3469034
description:
[2026-06-26 11:23:32 +0000] info [cpaneld] 45.236.5.23 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.34.89
country_id: 1282988
description:
[2026-06-26 11:23:34 +0000] info [cpaneld] 111.119.34.89 - aria "GET /login/?login_only=1&user=aria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aria (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 65.130.10.175
country_id: 6252001
description:
65.130.10.175 - - [26/Jun/2026:11:24:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789219&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473077 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e/index.php?cmd=newupld" "Mozilla/5.0 (Linux, Android 10, K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:65.130.10.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.141.51.180
country_id: 6252001
description:
209.141.51.180 - - [26/Jun/2026:11:24:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578841&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473085 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.141.51.180


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.82.96.179
country_id: 6252001
description:
23.82.96.179 - - [26/Jun/2026:11:24:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053572&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Ff3a3020310434ecafac47d1a395dcd36%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473072 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/f3a3020310434ecafac47d1a395dcd36/index.php?cmd=login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.82.96.179


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.36.143.231
country_id: 6252001
description:
136.36.143.231 - - [26/Jun/2026:11:24:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180913&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473080 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.36.143.231


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.10.54
country_id: 6252001
description:
[2026-06-26 11:24:57 +0000] info [cpaneld] 195.63.10.54 - uubplgpf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.80.26.4
country_id: 2661886
description:
88.80.26.4 - zxtqbmmj [26/Jun/2026:11:24:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169481&pdata=https%253A%252F%252Fperfect-labo.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473097 HTTP/2.0" 302 0 perfect-labo.com "https://perfect-labo.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.80.26.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [26/Jun/2026:11:25:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132075&pdata=https%253A%252F%252Fahoefa.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473098 HTTP/2.0" 302 0 ahoefa.tg "https://ahoefa.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 26 11:24:13 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [26/Jun/2026:11:26:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050854&pdata=http%253A%252F%252Fsahamtg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473173 HTTP/1.1" 302 0 sahamtg.com "http://sahamtg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-06-26 11:26:17 dovecot_login authenticator failed for H=([182.95.90.57]) [182.95.230.122]:38294: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.5.147
country_id: 798544
description:
Jun 26 11:26:42 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.5.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.127
country_id: 3175395
description:
Jun 26 11:27:17 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.246.81.235
country_id: 2017370
description:
[2026-06-26 11:30:02 +0000] info [cpaneld] 80.246.81.235 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.172.149
country_id: 3469034
description:
[2026-06-26 11:30:08 +0000] info [cpaneld] 170.238.172.149 - centiftg "GET /login/?login_only=1&user=centiftg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user centiftg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.156.164.100
country_id: 1643084
description:
[2026-06-26 11:29:24 +0000] info [cpaneld] 103.156.164.100 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.135.135.32
country_id: 1210997
description:
[2026-06-26 11:30:15 +0000] info [cpaneld] 103.135.135.32 - centi "GET /login/?login_only=1&user=centi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user centi (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.54.72.67
country_id: 1512440
description:
84.54.72.67 - - [26/Jun/2026:11:30:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132072&pdata=https%253A%252F%252Fcfpj.tg%252Fyedk-307513zetidm67lez.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782473435 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/yedk-307513zetidm67lez.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.54.72.67


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.247.186.232
country_id: 102358
description:
[2026-06-26 11:30:18 +0000] info [cpaneld] 142.247.186.232 - cent "GET /login/?login_only=1&user=cent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.60.14
country_id: 99237
description:
[2026-06-26 11:31:20 +0000] info [cpaneld] 185.24.60.14 - togoagr "GET /login/?login_only=1&user=togoagr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.38.41.95
country_id: 690791
description:
[2026-06-26 11:31:24 +0000] info [cpaneld] 92.38.41.95 - togoag "GET /login/?login_only=1&user=togoag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.187.90.96
country_id: 1562822
description:
[2026-06-26 11:31:28 +0000] info [cpaneld] 113.187.90.96 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.234.203.29
country_id: 1210997
description:
[2026-06-26 11:31:35 +0000] info [cpaneld] 103.234.203.29 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 26 11:31:56 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.7.207
country_id: 2363686
description:
[2026-06-26 11:32:04 +0000] info [webmaild] 196.171.7.207 - cndhtogo@cndh-togo.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.60.48
country_id: 99237
description:
[2026-06-26 11:31:15 +0000] info [cpaneld] 185.24.60.48 - togoagro "GET /login/?login_only=1&user=togoagro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.38.41
country_id: 3895114
description:
[2026-06-26 11:32:32 +0000] info [cpaneld] 195.86.38.41 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cndhtogo@cndh-togo.org [06/26/2026:11:33:23 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cndhtogo@cndh-togo.org


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.238.229
country_id: 3469034
description:
[2026-06-26 11:34:40 +0000] info [cpaneld] 191.5.238.229 - dir "GET /login/?login_only=1&user=dir&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dir (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.88.104.19
country_id: 1522867
description:
[2026-06-26 11:34:21 +0000] info [cpaneld] 178.88.104.19 - direct7 "GET /login/?login_only=1&user=direct7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.5.210.71
country_id: 2921044
description:
[2026-06-26 11:34:28 +0000] info [cpaneld] 91.5.210.71 - direct "GET /login/?login_only=1&user=direct&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.39.232.181
country_id: 285570
description:
[2026-06-26 11:34:37 +0000] info [cpaneld] 37.39.232.181 - dire "GET /login/?login_only=1&user=dire&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dire (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 105.21.66.86
country_id: 226074
description:
[2026-06-26 11:36:28 +0000] info [cpaneld] 105.21.66.86 - pnls "GET /cpsess2848472100/frontend/jupiter/index.html?=undefined&login=1&post_login=18384355238846 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.134.149.83] != Current IP Address [105.21.66.86]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.86.211.109
country_id: 690791
description:
Jun 26 11:40:44 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.86.211.109 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.128
country_id: 1880251
description:
47.128.121.128 - - [26/Jun/2026:11:41:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460570&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fhospital-charity%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782474090 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/hospital-charity/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.177.170
country_id: 3996063
description:
[2026-06-26 11:41:45 +0000] info [cpaneld] 187.190.177.170 - tilitulab "GET /login/?login_only=1&user=tilitulab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.230.190
country_id: 3686110
description:
[2026-06-26 11:41:48 +0000] info [cpaneld] 38.156.230.190 - tilitulabtg "GET /login/?login_only=1&user=tilitulabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.108.20.28
country_id: 294640
description:
[2026-06-26 11:42:08 +0000] info [cpaneld] 84.108.20.28 - tili "GET /login/?login_only=1&user=tili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.54.156.137
country_id: 1282988
description:
[2026-06-26 11:41:42 +0000] info [cpaneld] 182.54.156.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.192.43
country_id: 99237
description:
[2026-06-26 11:42:02 +0000] info [cpaneld] 185.56.192.43 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.41.105
country_id: 6251999
description:
[2026-06-26 11:42:05 +0000] info [cpaneld] 153.67.41.105 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 13.42.84.27
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 13.42.84.27: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.132.81.11
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 18.132.81.11: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.221
country_id: 3017382
description:
[2026-06-26 11:42:28 +0000] info [cpaneld] 5.231.64.221 NEW frtwilql:e6h0I_Tpqd95DYrN address=5.231.64.221,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.90.198.187
country_id: 2921044
description:
[2026-06-26 11:42:19 +0000] info [cpaneld] 95.90.198.187 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.27.41.40
country_id: 6252001
description:
[2026-06-26 11:42:33 +0000] info [cpaneld] 100.27.41.40 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.171
country_id: 1880251
description:
43.173.175.171 - - [26/Jun/2026:11:43:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646167&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F26032&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782474204 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/26032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.171


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.254.241.211
country_id: 1880251
description:
Jun 26 11:43:30 ns5 pure-ftpd[363668]: (?@167.254.241.211) [INFO] New connection from 167.254.241.211


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.246.166.14
country_id: 3077311
description:
84.246.166.14 - - [26/Jun/2026:11:43:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092710&pdata=https%253A%252F%252Ftogodailynews.tg%252Fentree-du-togo-au-commonwealth-yawa-djigbodi-tsegan-adresse-ses-felicitations-a-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782474193 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/entree-du-togo-au-commonwealth-yawa-djigbodi-tsegan-adresse-ses-felicitations-a-faure-gnassingbe/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2410.1067 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.246.166.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.254.241.211
country_id: 1880251
description:
[2026-06-26 11:43:30 +0000] info [whostmgrd] 167.254.241.211 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 167.254.241.211
country_id: 1880251
description:
Jun 26 11:43:35 ns5 pure-ftpd[363668]: (?@167.254.241.211) [WARNING] Authentication failed for user [AMEDEKA]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.139.203
country_id: 2363686
description:
[2026-06-26 11:44:22 +0000] info [webmaild] 196.168.139.203 - emt@emt.tg "POST /cpsess4357737500/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.29.120] != Current IP Address [196.168.139.203]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.228
country_id: 2363686
description:
[2026-06-26 11:47:11 +0000] info [cpaneld] 102.176.253.228 - ucaouut "GET /cpsess6952679915/frontend/jupiter/index.html?=undefined&login=1&post_login=25527885593177 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.176.253.226] != Current IP Address [102.176.253.228]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.151
country_id: 2300660
description:
Jun 26 11:47:49 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-26 11:50:06 +0000] info [webmaild] 102.176.253.226 - dgi@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.232.146
country_id: 6252001
description:
[2026-06-26 11:50:09 +0000] info [cpaneld] 194.180.232.146 - einguval "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.8
country_id: 2635167
description:
[2026-06-26 11:49:18 +0000] info [cpaneld] 195.63.24.8 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 152.136.56.16
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/tir-a-larc-togolais-un-an-daction-un-cap-affirme-vers-lavenir/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.26.205.154
country_id: 1814991
description:
Jun 26 11:50:44 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.26.205.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.107.128.64
country_id: 3686110
description:
[2026-06-26 11:53:37 +0000] info [cpaneld] 191.107.128.64 - fastsolu "GET /login/?login_only=1&user=fastsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.15.129.5
country_id: 2017370
description:
[2026-06-26 11:53:40 +0000] info [cpaneld] 217.15.129.5 - fastsol "GET /login/?login_only=1&user=fastsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.86.29
country_id: 2542007
description:
[2026-06-26 11:53:43 +0000] info [cpaneld] 41.251.86.29 - fastso "GET /login/?login_only=1&user=fastso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.200.34.105
country_id: 3469034
description:
[2026-06-26 11:53:47 +0000] info [cpaneld] 177.200.34.105 - fasts "GET /login/?login_only=1&user=fasts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fasts (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.54.169.251
country_id: 390903
description:
[2026-06-26 11:53:50 +0000] info [cpaneld] 5.54.169.251 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.195.89
country_id: 99237
description:
[2026-06-26 11:53:57 +0000] info [cpaneld] 185.56.195.89 - fa "GET /login/?login_only=1&user=fa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.137.124
country_id: 3895114
description:
[2026-06-26 11:53:33 +0000] info [cpaneld] 153.67.137.124 - fastsolutiontg "GET /login/?login_only=1&user=fastsolutiontg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutiontg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.27.41.40
country_id: 6252001
description:
[2026-06-26 11:56:59 +0000] info [cpaneld] 100.27.41.40 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.23
country_id: 2395170
description:
197.234.221.23 - - [26/Jun/2026:11:57:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185886&pdata=https%253A%252F%252Fwebmail.supermercandotogo.free.netmaster.tg%252F%253Flocale%253Dtr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782475067 HTTP/2.0" 302 0 webmail.supermercandotogo.free.netmaster.tg "https://webmail.supermercandotogo.free.netmaster.tg/?locale=tr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.234.221.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.27.41.40
country_id: 6252001
description:
[2026-06-26 12:00:33 +0000] info [cpaneld] 100.27.41.40 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.191.202.104
country_id: 1694008
description:
[2026-06-26 12:01:05 +0000] info [cpaneld] 180.191.202.104 - togodail "GET /login/?login_only=1&user=togodail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.24.203.49
country_id: 298795
description:
[2026-06-26 12:00:49 +0000] info [cpaneld] 78.24.203.49 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.254.39.233
country_id: 3469034
description:
[2026-06-26 12:00:55 +0000] info [cpaneld] 170.254.39.233 - togodailynews "GET /login/?login_only=1&user=togodailynews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.128.163.107
country_id: 3686110
description:
[2026-06-26 12:00:58 +0000] info [cpaneld] 181.128.163.107 - togodailynewstg "GET /login/?login_only=1&user=togodailynewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynewstg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 188.26.197.113
country_id: 2510769
description:
188.26.197.113 proxy - [06/26/2026:12:01:11 -0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211799&pdata=https%253A%252F%252Fwebmail.maquette-mpa.free.netmaster.tg%252F%253Flocale%253Dpt&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782475263 HTTP/1.1" 404 0 "https://webmail.maquette-mpa.free.netmaster.tg/?locale=pt" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" "-" "X-Forwarded-For: 188.26.197.113" 443


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.106.110
country_id: 798544
description:
Jun 26 12:00:23 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.106.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.63.33.130
country_id: 3865483
description:
[2026-06-26 12:01:11 +0000] info [cpaneld] 179.63.33.130 - togodai "GET /login/?login_only=1&user=togodai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodai (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.35.11.90
country_id: 953987
domain: belali.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:dmmkifel||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.173.129.69
country_id: 3996063
description:
[2026-06-26 12:01:29 +0000] info [cpaneld] 187.173.129.69 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.174.197.170
country_id: 2017370
description:
[2026-06-26 12:01:34 +0000] info [cpaneld] 85.174.197.170 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 128.1.120.231
country_id: 2921044
domain: www.fbafrica.com
description:
IM360 WAF: Request body parsing error||err_msg:Multipart: Boundary not found in C-T.||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.232.74.97
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/1ere-session-de-2026-les-conseillers-regionaux-de-la-kara-a-loeuvre/<script async src=||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.96.166.71
country_id: 6252001
description:
[2026-06-26 12:10:28 +0000] info [whostmgrd] 199.96.166.71 - cp909049p23 "POST /login/?login HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.102.157
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.102.157: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-26 12:14:14 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:50083: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.171.203
country_id: 6252001
description:
[2026-06-26 12:15:48 +0000] info [cpaneld] 140.235.171.203 - masfloy "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.12.204
country_id: 3077311
description:
Jun 26 12:16:53 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.12.204 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [26/Jun/2026:12:17:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7498132&pdata=https%253A%252F%252Ftogointerim.net%252Flang%252Ffr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782476232 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/lang/fr" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.81.194.61
country_id: 6252001
description:
[2026-06-26 12:18:58 +0000] info [cpaneld] 97.81.194.61 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.163.207.150
country_id: 6252001
description:
[2026-06-26 12:19:07 +0000] info [cpaneld] 73.163.207.150 - camegtogotg "GET /login/?login_only=1&user=camegtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.240.171
country_id: 6252001
description:
[2026-06-26 12:19:17 +0000] info [cpaneld] 172.59.240.171 - camegt "GET /login/?login_only=1&user=camegt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.2.227.243
country_id: 6252001
description:
[2026-06-26 12:19:31 +0000] info [whostmgrd] 38.2.227.243 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.235.200.86
country_id: 6252001
description:
[2026-06-26 12:19:31 +0000] info [cpaneld] 67.235.200.86 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.7.251.138
country_id: 6252001
description:
[2026-06-26 12:19:20 +0000] info [cpaneld] 73.7.251.138 - cameg "GET /login/?login_only=1&user=cameg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cameg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.178.253
country_id: 6252001
description:
[2026-06-26 12:19:31 +0000] info [cpaneld] 76.150.178.253 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.1.184.203
country_id: 6252001
description:
[2026-06-26 12:19:36 +0000] info [cpaneld] 104.1.184.203 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.172.134.34
country_id: 6252001
description:
[2026-06-26 12:19:14 +0000] info [cpaneld] 71.172.134.34 - camegto "GET /login/?login_only=1&user=camegto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.45.145.220
country_id: 6252001
description:
[2026-06-26 12:19:27 +0000] info [cpaneld] 73.45.145.220 - cam "GET /login/?login_only=1&user=cam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.144.188.255
country_id: 6252001
description:
[2026-06-26 12:19:27 +0000] info [cpaneld] 24.144.188.255 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.196.68.196
country_id: 6252001
description:
[2026-06-26 12:19:28 +0000] info [whostmgrd] 107.196.68.196 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.138.208.4
country_id: 6252001
description:
[2026-06-26 12:19:35 +0000] info [whostmgrd] 35.138.208.4 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.49.246.37
country_id: 6252001
description:
[2026-06-26 12:20:32 +0000] info [cpaneld] 174.49.246.37 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.204.75.219
country_id: 1814991
description:
116.204.75.219 - - [26/Jun/2026:12:20:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247050&pdata=https%253A%252F%252Fmail.ucao-uut.tg%252Factualites-evenements%252Fevenements%252Ftournois-de-lintegration&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782476443 HTTP/2.0" 302 0 mail.ucao-uut.tg "https://mail.ucao-uut.tg/actualites-evenements/evenements/tournois-de-lintegration" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.204.75.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.121.10.44
country_id: 6252001
description:
[2026-06-26 12:20:28 +0000] info [cpaneld] 69.121.10.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.124.182.75
country_id: 6252001
description:
[2026-06-26 12:20:38 +0000] info [cpaneld] 38.124.182.75 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.207.195.251
country_id: 6252001
description:
[2026-06-26 12:20:41 +0000] info [cpaneld] 67.207.195.251 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.114.154.113
country_id: 6252001
description:
[2026-06-26 12:20:49 +0000] info [cpaneld] 69.114.154.113 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.111.114.6
country_id: 6252001
description:
[2026-06-26 12:20:55 +0000] info [cpaneld] 98.111.114.6 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.135.161.103
country_id: 6252001
description:
[2026-06-26 12:20:27 +0000] info [whostmgrd] 35.135.161.103 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.140.91.163
country_id: 6252001
description:
[2026-06-26 12:20:45 +0000] info [cpaneld] 174.140.91.163 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.252.173.74
country_id: 6252001
description:
[2026-06-26 12:20:22 +0000] info [whostmgrd] 209.252.173.74 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.122.202
country_id: 6252001
description:
[2026-06-26 12:20:52 +0000] info [cpaneld] 73.151.122.202 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.23.154
country_id: 6252001
description:
[2026-06-26 12:22:04 +0000] info [cpaneld] 97.171.23.154 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.116.202
country_id: 6252001
description:
[2026-06-26 12:21:58 +0000] info [cpaneld] 172.58.116.202 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.82.147.192
country_id: 6252001
description:
[2026-06-26 12:22:01 +0000] info [cpaneld] 68.82.147.192 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.240.53
country_id: 6252001
description:
[2026-06-26 12:21:27 +0000] info [cpaneld] 172.58.240.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.226.20.24
country_id: 6252001
description:
[2026-06-26 12:21:32 +0000] info [cpaneld] 98.226.20.24 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.13.209
country_id: 241170
description:
[2026-06-26 12:22:17 +0000] info [whostmgrd] 31.134.13.209 - 91536897 "POST /login/?login HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.76
country_id: 3469034
description:
Jun 26 12:23:31 ns5 auth[57051]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.223.83
country_id: 1269750
description:
2026-06-26 12:23:39 dovecot_login authenticator failed for H=(103.51.223.83) [103.51.223.83]:48065: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.154.110
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:46.203.154.110||TA:46.203.154.110||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.71.105.89
country_id: 1168579
description:
[2026-06-26 12:25:07 +0000] info [cpaneld] 116.71.105.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.248.77.75
country_id: 294640
description:
[2026-06-26 12:25:10 +0000] info [cpaneld] 178.248.77.75 - togocarrierebetons "GET /login/?login_only=1&user=togocarrierebetons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetons (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.102.223.200
country_id: 660013
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:172.102.223.200||TA:172.102.223.200||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.105.193.29
country_id: 2464461
description:
[2026-06-26 12:25:15 +0000] info [cpaneld] 102.105.193.29 - togocarrierebetonstg "GET /login/?login_only=1&user=togocarrierebetonstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetonstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.121.57.204
country_id: 1733045
description:
[2026-06-26 12:25:28 +0000] info [cpaneld] 121.121.57.204 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.179.94.162
country_id: 2750405
description:
[2026-06-26 12:25:22 +0000] info [cpaneld] 143.179.94.162 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.181.180.50
description:
[2026-06-26 12:25:31 +0000] info [cpaneld] 70.181.180.50 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [26/Jun/2026:12:25:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529443&pdata=https%253A%252F%252Fsoena.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782476730 HTTP/2.0" 302 0 soena.tg "https://soena.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.161.32
country_id: 2510769
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:109.196.161.32||TA:109.196.161.32||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 85.12.31.142
country_id: 6251999
description:
Jun 26 12:27:15 ns5 pure-ftpd[384384]: (?@85.12.31.142) [WARNING] Authentication failed for user [ingertgsarl]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 180.252.87.103
country_id: 1643084
description:
[2026-06-26 12:29:20 +0000] info [cpaneld] 180.252.87.103 NEW tgkkwsvr:SF3Mpi0E7vxPO16m address=180.252.87.103,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.199.219
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:140.99.199.219||TA:140.99.199.219||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.152.54.2
country_id: 3595528
description:
[2026-06-26 12:32:07 +0000] info [cpaneld] 24.152.54.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.242.138
country_id: 2510769
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:92.113.242.138||TA:92.113.242.138||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.191.52.174
country_id: 3469034
description:
[2026-06-26 12:32:42 +0000] info [cpaneld] 181.191.52.174 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.217.168
country_id: 294640
description:
[2026-06-26 12:32:15 +0000] info [cpaneld] 147.235.217.168 - ekeasarlcom "GET /login/?login_only=1&user=ekeasarlcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarlcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.253.151.76
country_id: 3932488
description:
[2026-06-26 12:32:33 +0000] info [cpaneld] 38.253.151.76 - ekea "GET /login/?login_only=1&user=ekea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.64.100
country_id: 3469034
description:
[2026-06-26 12:32:19 +0000] info [cpaneld] 45.4.64.100 - ekeasar "GET /login/?login_only=1&user=ekeasar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.204.166.109
country_id: 1835841
description:
[2026-06-26 12:32:30 +0000] info [cpaneld] 114.204.166.109 - ekeas "GET /login/?login_only=1&user=ekeas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeas (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 170.199.224.250
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:170.199.224.250||TA:170.199.224.250||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.10.28
country_id: 99237
description:
[2026-06-26 12:32:12 +0000] info [cpaneld] 169.224.10.28 - ekeasarl "GET /login/?login_only=1&user=ekeasarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.213
country_id: 6252001
description:
Jun 26 12:33:57 ns5 pure-ftpd[388755]: (?@45.38.16.213) [WARNING] Authentication failed for user [ingertgsarl]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.91.160
country_id: 1880251
description:
[2026-06-26 12:33:59 +0000] info [cpaneld] 146.190.91.160 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.192.189.7
country_id: 2017370
description:
[2026-06-26 12:35:53 +0000] info [cpaneld] 85.192.189.7 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.166.100.52
country_id: 1282988
description:
[2026-06-26 12:36:01 +0000] info [cpaneld] 103.166.100.52 - togofee "GET /login/?login_only=1&user=togofee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.174.207.255
country_id: 2017370
description:
[2026-06-26 12:36:05 +0000] info [cpaneld] 85.174.207.255 - togofe "GET /login/?login_only=1&user=togofe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.72.172
country_id: 1512440
description:
[2026-06-26 12:35:58 +0000] info [cpaneld] 84.54.72.172 - togofeedtg "GET /login/?login_only=1&user=togofeedtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeedtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.163.207.229
country_id: 6252001
description:
[2026-06-26 12:36:06 +0000] info [cpaneld] 193.163.207.229 - whmcsadmin "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.32
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:142.147.132.32||TA:142.147.132.32||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.164.44.94
country_id: 798544
description:
104.164.44.94 - - [26/Jun/2026:12:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116436&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ffinance-islamique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782477427 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/finance-islamique/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2122.1741 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.164.44.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.46.28
country_id: 1733045
description:
[2026-06-26 12:36:19 +0000] info [cpaneld] 180.75.46.28 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.187.126.218
country_id: 3469034
description:
[2026-06-26 12:36:31 +0000] info [cpaneld] 45.187.126.218 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.24.69
country_id: 2363686
description:
[2026-06-26 12:36:58 +0000] info [webmaild] 196.169.24.69 - chef.dgi@ucao-uut.tg "POST /cpsess4050956846/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.176.253.226] != Current IP Address [196.169.24.69]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.10.201
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.238.10.201||TA:104.238.10.201||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.233.138
country_id: 6252001
description:
[2026-06-26 12:37:54 +0000] info [cpaneld] 194.180.233.138 - netmast "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.212.115.183
country_id: 6252001
description:
[2026-06-26 12:37:39 +0000] info [cpaneld] 185.212.115.183 - stephanetg "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephanetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.91.160
country_id: 1880251
description:
[2026-06-26 12:38:36 +0000] info [whostmgrd] 146.190.91.160 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.78.189.191
country_id: 2017370
description:
[2026-06-26 12:40:50 +0000] info [cpaneld] 37.78.189.191 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.151.190.29
country_id: 3585968
description:
[2026-06-26 12:40:42 +0000] info [cpaneld] 190.151.190.29 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.63.145.227
country_id: 3469034
description:
[2026-06-26 12:40:55 +0000] info [cpaneld] 179.63.145.227 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.74.237.132
country_id: 3625428
description:
[2026-06-26 12:41:02 +0000] info [cpaneld] 38.74.237.132 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.10.47.48
country_id: 1643084
description:
[2026-06-26 12:41:06 +0000] info [cpaneld] 114.10.47.48 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.183.88
country_id: 2464461
description:
[2026-06-26 12:41:14 +0000] info [cpaneld] 102.31.183.88 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.109.32.67
country_id: 6252001
description:
[2026-06-26 12:43:25 +0000] info [cpaneld] 74.109.32.67 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.24.224
country_id: 6252001
description:
[2026-06-26 12:43:29 +0000] info [cpaneld] 172.56.24.224 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.103.229.254
country_id: 2635167
description:
[2026-06-26 12:43:44 +0000] info [cpaneld] 212.103.229.254 - aifkjzqm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.107.214.32
country_id: 6252001
description:
[2026-06-26 12:43:54 +0000] info [cpaneld] 209.107.214.32 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.82.38.64
country_id: 6252001
description:
[2026-06-26 12:43:56 +0000] info [cpaneld] 67.82.38.64 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.253.19.91
country_id: 6252001
description:
[2026-06-26 12:45:08 +0000] info [whostmgrd] 167.253.19.91 - apluser "POST /login/?login HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 221.5.212.14
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 221.5.212.14: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.45.80
country_id: 3895114
description:
[2026-06-26 12:48:47 +0000] info [cpaneld] 190.114.45.80 - lesn "GET /login/?login_only=1&user=lesn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesn (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.50.4.169
country_id: 4566966
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/climat-des-affaires-au-togo-une-lisibilite-accrue-pour-attirer-les-capitaux/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.172.223.114
country_id: 3686110
description:
[2026-06-26 12:48:20 +0000] info [cpaneld] 38.172.223.114 - lesnidsurbains "GET /login/?login_only=1&user=lesnidsurbains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.37.14
country_id: 1643084
description:
[2026-06-26 12:48:33 +0000] info [cpaneld] 157.66.37.14 - lesnids "GET /login/?login_only=1&user=lesnids&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnids (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.140.5.42
country_id: 1733045
description:
[2026-06-26 12:48:54 +0000] info [cpaneld] 120.140.5.42 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.99.69.19
country_id: 2589581
description:
[2026-06-26 12:48:24 +0000] info [cpaneld] 41.99.69.19 - lesnidsurbainstg "GET /login/?login_only=1&user=lesnidsurbainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbainstg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.49.33
country_id: 2245662
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/climat-des-affaires-au-togo-une-lisibilite-accrue-pour-attirer-les-capitaux/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.66.109.218
country_id: 3469034
description:
[2026-06-26 12:48:28 +0000] info [cpaneld] 177.66.109.218 - lesnidsu "GET /login/?login_only=1&user=lesnidsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.213.132.183
country_id: 3996063
description:
[2026-06-26 12:48:37 +0000] info [cpaneld] 187.213.132.183 - lesnid "GET /login/?login_only=1&user=lesnid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.161.12.111
country_id: 3469034
description:
[2026-06-26 12:48:44 +0000] info [cpaneld] 131.161.12.111 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.142.150
country_id: 783754
description:
[2026-06-26 12:49:36 +0000] info [cpaneld] 141.98.142.150 - ese2i "GET /login/?login_only=1&user=ese2i&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2i (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.170.58
country_id: 3932488
description:
[2026-06-26 12:49:46 +0000] info [cpaneld] 179.6.170.58 - ese2 "GET /login/?login_only=1&user=ese2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2 (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.137
country_id: 1880251
description:
43.173.179.137 - - [26/Jun/2026:12:49:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936556&pdata=https%253A%252F%252F24heureinfo.tg%252Fflash-info%252Ftogo-recensement-electoral-lanc-denonce-une-cacophonie&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782478156 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/flash-info/togo-recensement-electoral-lanc-denonce-une-cacophonie" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.208.148.118
country_id: 3351879
description:
[2026-06-26 12:49:51 +0000] info [cpaneld] 102.208.148.118 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.253.197
country_id: 3865483
description:
[2026-06-26 12:51:05 +0000] info [cpaneld] 179.60.253.197 - metaart "GET /login/?login_only=1&user=metaart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaart (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 222.164.58.17
country_id: 1880251
description:
[2026-06-26 12:51:27 +0000] info [cpaneld] 222.164.58.17 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.224.205
country_id: 3658394
description:
[2026-06-26 12:51:17 +0000] info [cpaneld] 177.234.224.205 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.228.225.2
country_id: 6252001
description:
[2026-06-26 12:52:52 +0000] info [cpaneld] 24.228.225.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.69.23.76
country_id: 6252001
description:
[2026-06-26 12:52:58 +0000] info [cpaneld] 71.69.23.76 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.137.234.18
country_id: 6252001
description:
[2026-06-26 12:53:01 +0000] info [cpaneld] 69.137.234.18 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.125
country_id: 1880251
description:
43.173.179.125 - - [26/Jun/2026:12:52:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924716&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F25567&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782478364 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/25567" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.205.198
country_id: 2413451
description:
2026-06-26 12:52:30 dovecot_login authenticator failed for H=([197.255.205.198]) [197.255.205.198]:56307: 535 Incorrect authentication data (set_id=help@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.91.98.36
country_id: 6252001
description:
[2026-06-26 12:53:04 +0000] info [cpaneld] 173.91.98.36 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.56.78.137
country_id: 6252001
description:
[2026-06-26 12:53:07 +0000] info [cpaneld] 73.56.78.137 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.219.185.195
country_id: 6252001
description:
[2026-06-26 12:53:22 +0000] info [cpaneld] 104.219.185.195 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.84.103.170
country_id: 6252001
description:
[2026-06-26 12:53:11 +0000] info [cpaneld] 73.84.103.170 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.2.45.135
country_id: 6252001
description:
[2026-06-26 12:53:14 +0000] info [cpaneld] 24.2.45.135 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.92.137.50
country_id: 6252001
description:
[2026-06-26 12:53:17 +0000] info [cpaneld] 173.92.137.50 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 159.65.7.198
country_id: 1880251
domain: mine.ex-girlfriendis.best
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/mine.ex-girlfriendis.best/subscribe/b2d438ac6fe7497a9abb1dc7a1264a44 HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.57.199.59
country_id: 3175395
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2024/04/Recrutement-stagiaire-communication-15124_inputCP_VF.pdf HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.4.252
country_id: 6252001
description:
[2026-06-26 12:57:12 +0000] info [whostmgrd] 195.63.4.252 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.126.153
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:184.174.126.153||TA:184.174.126.153||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.207.207
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:151.245.207.207||TA:151.245.207.207||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.102.180
country_id: 458258
domain: mo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:45.131.102.180||TA:45.131.102.180||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.109.206
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/economie-bleue-le-togo-consolide-sa-strategie/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.217.244
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:38.154.217.244||TA:38.154.217.244||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.33.141
country_id: 6251999
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.239.33.141||TA:104.239.33.141||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.158.131
country_id: 1733045
description:
161.142.158.131 - - [26/Jun/2026:13:03:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315157&pdata=https%253A%252F%252Fcpanel.helfinger.free.netmaster.tg%252F%253Flocale%253Dpt&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782479022 HTTP/2.0" 302 0 cpanel.helfinger.free.netmaster.tg "https://cpanel.helfinger.free.netmaster.tg/?locale=pt" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.158.131


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.228.167
country_id: 2661886
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:92.112.228.167||TA:92.112.228.167||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.153.46.66
country_id: 6252001
description:
[2026-06-26 13:04:47 +0000] info [cpaneld] 164.153.46.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.148.24.37
country_id: 6252001
description:
[2026-06-26 13:05:01 +0000] info [cpaneld] 76.148.24.37 - davetech "GET /login/?login_only=1&user=davetech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetech (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.239.216.6
country_id: 2658434
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-04.173.239.216.6||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.196.182
country_id: 798544
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:46.203.196.182||TA:46.203.196.182||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.58.157.102
country_id: 6252001
description:
[2026-06-26 13:05:09 +0000] info [cpaneld] 174.58.157.102 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.177.163
country_id: 6252001
description:
[2026-06-26 13:05:50 +0000] info [cpaneld] 104.32.177.163 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.108.36.123
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-kenya-une-nouvelle-directrice-pour-consolider-la-croissance-et-la-solidite-financiere/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.115.155
country_id: 6252001
description:
[2026-06-26 13:05:19 +0000] info [cpaneld] 71.203.115.155 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.241.216
country_id: 6252001
description:
[2026-06-26 13:05:44 +0000] info [cpaneld] 172.58.241.216 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.193.1.162
country_id: 6252001
description:
[2026-06-26 13:06:10 +0000] info [cpaneld] 68.193.1.162 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.211.184
country_id: 6252001
description:
[2026-06-26 13:05:22 +0000] info [cpaneld] 172.56.211.184 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.108.36.123
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-kenya-une-nouvelle-directrice-pour-consolider-la-croissance-et-la-solidite-financiere/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.219.196.17
country_id: 6252001
description:
[2026-06-26 13:05:12 +0000] info [cpaneld] 47.219.196.17 - davet "GET /login/?login_only=1&user=davet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.27.19.37
country_id: 6252001
description:
[2026-06-26 13:05:56 +0000] info [cpaneld] 108.27.19.37 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.137.120.151
country_id: 6252001
description:
[2026-06-26 13:06:15 +0000] info [cpaneld] 35.137.120.151 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.205.238
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:38.154.205.238||TA:38.154.205.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.208
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:206.232.103.208||TA:206.232.103.208||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.46.246.188
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:198.46.246.188||TA:198.46.246.188||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.137.60
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:107.173.137.60||TA:107.173.137.60||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.235.216
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:166.88.235.216||TA:166.88.235.216||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.102.99
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:152.232.102.99||TA:152.232.102.99||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.33.138
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.239.33.138||TA:104.239.33.138||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 59.153.91.247
country_id: 1327865
description:
Denial of Service (DoS) attack was discovered from 59.153.91.247: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.176.188.186
country_id: 6252001
description:
[2026-06-26 13:14:43 +0000] info [cpaneld] 98.176.188.186 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.96.240.25
country_id: 290557
description:
[2026-06-26 13:14:52 +0000] info [cpaneld] 92.96.240.25 - tps "GET /login/?login_only=1&user=tps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tps (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.149.20.141
country_id: 6252001
description:
[2026-06-26 13:14:49 +0000] info [cpaneld] 24.149.20.141 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.60.209
country_id: 6252001
description:
[2026-06-26 13:14:24 +0000] info [cpaneld] 108.46.60.209 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


