# incident

plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.72.20
country_id: 2363686
description:
[2026-06-29 15:27:10 +0000] info [webmaild] 80.248.72.20 - support@cloud-et-racks.tg "POST /cpsess1092190813/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [80.248.72.20]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.97.130.150
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/hommage-du-peuple-togolais-au-pere-de-la-nation/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 15:29:18 +0000] info [cpaneld] 167.99.236.81 - pharma "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.230.34.85
country_id: 3895114
description:
2026-06-29 15:31:16 dovecot_plain authenticator failed for H=([69.172.210.47]) [152.230.34.85]:52022: 535 Incorrect authentication data (set_id=support@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.181
country_id: 2395170
description:
41.79.219.181 - - [29/Jun/2026:15:32:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065250&pdata=https%253A%252F%252Fave2.mairie.tg%252Forganigramme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782747156 HTTP/2.0" 302 0 ave2.mairie.tg "https://ave2.mairie.tg/organigramme/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.181


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.20.141
country_id: 2363686
domain: portail.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">bonjour m. gamal,</span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">je viens vous relancer par apport au devis de remplacement de l'alimentation du lecteur du coffre \xc3\xa0 l'agence soted.</span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">nous restons en attente...</span></p><p><br></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">bien \xc3\xa0 vous!</span></p><p><br></p>||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.42.163.98
country_id: 3895114
description:
181.42.163.98 - - [29/Jun/2026:15:33:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842772&pdata=https%253A%252F%252Ftogodailynews.tg%252Fe-id-les-enregistrements-de-masse-demarrent-le-20-aout-prochain-a-agoe-nyive%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782747225 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/e-id-les-enregistrements-de-masse-demarrent-le-20-aout-prochain-a-agoe-nyive/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4256.1042 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.42.163.98


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 15:35:02 +0000] info [cpaneld] 167.99.236.81 - e.sanvee "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.20.141
country_id: 2363686
domain: portail.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">bonjour donn\xc3\xa9,</span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">je vous relance relativement au devis de remplacement de la centrale d'incendie et du d\xc3\xa9tecteur \xc3\xa0 l'agence agbalepedo. </span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">nous restons en attente...</span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">bien \xc3\xa0 vous!</span></p><p><br></p><p><br></p>||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.25
country_id: 1880251
description:
47.128.112.25 - - [29/Jun/2026:15:41:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066326&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D2090&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782747717 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=2090" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.25


plugin: modsec
rule: 77277976
name: IM360 WAF: XMLRPC getUsersBlogs RBL infectors
abuser: 91.245.236.143
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL infectors||Username:Ajatovivi1994.www.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.202.222.195
country_id: 1210997
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/presentation HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.166.20
country_id: 6252001
description:
[2026-06-29 15:46:31 +0000] info [cpaneld] 172.58.166.20 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 15:46:30 +0000] info [cpaneld] 175.100.83.30 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.115.206.19
country_id: 6252001
description:
[2026-06-29 15:46:18 +0000] info [cpaneld] 73.115.206.19 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.64.23.83
country_id: 6252001
description:
[2026-06-29 15:46:28 +0000] info [cpaneld] 173.64.23.83 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.177.124.178
country_id: 6252001
description:
[2026-06-29 15:46:12 +0000] info [cpaneld] 66.177.124.178 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.57.142.187
country_id: 6252001
description:
[2026-06-29 15:46:20 +0000] info [cpaneld] 73.57.142.187 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.34.244.97
country_id: 6252001
description:
[2026-06-29 15:46:24 +0000] info [cpaneld] 65.34.244.97 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.21.186.170
country_id: 6252001
description:
[2026-06-29 15:46:33 +0000] info [cpaneld] 67.21.186.170 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.108.220.13
country_id: 6252001
description:
[2026-06-29 15:46:15 +0000] info [cpaneld] 75.108.220.13 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.20.141
country_id: 2363686
domain: portail.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">bonsoir m. gamal,</span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">je vous relance pour le devis de remplacement du p\xc3\xa9dale \xc3\xa0 l'agence hedzranawoe.</span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">en attente...</span></p><p><span style=\"background-color: rgb(247, 247, 249); color: rgb(47, 51, 73);\">bien \xc3\xa0 vous!</span></p><p><br></p>||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.52.245
country_id: 1210997
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/prubeneficial.tg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-06-29 15:53:47 +0000] info [cpaneld] 144.91.125.41 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 15:56:47 +0000] info [cpaneld] 129.212.228.74 - web_tv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-59.213.32.21.59||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 16:00:32 +0000] info [cpaneld] 167.99.236.81 - mpqypjjp "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-29 16:02:33 +0000] info [cpaneld] 51.83.4.64 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.46.167
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.46.167: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 16:02:16 +0000] info [cpaneld] 129.212.228.74 - myxlsnta "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.179.116
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.179.116: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 29 16:03:31 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.154.113.148
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:94.154.113.148||TA:94.154.113.148||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.197.27.109
country_id: 1269750
domain: fbafrica.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/arsjawjaz/public_html/wp-content||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.238.178.169
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.238.178.169: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.102.255.208
country_id: 3469034
description:
187.102.255.208 - - [29/Jun/2026:16:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800534&pdata=https%253A%252F%252Fcivilemagazine.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782749242 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.7299.1969 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.102.255.208


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.2
country_id: 1880251
description:
43.173.182.2 - - [29/Jun/2026:16:10:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078568&pdata=https%253A%252F%252Fsoena.tg%252Fshop%252Fbouffe%252Fpizzavi%252Fburgers%252Fburger-vegetarien%252F%253Fadd-to-cart%253D2034&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782749429 HTTP/1.1" 404 561 soena.tg "https://soena.tg/shop/bouffe/pizzavi/burgers/burger-vegetarien/?add-to-cart=2034" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.2


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.182.208
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/wingsn-shake/nos-omelettes/omelette-nature/?add-to-cart=1874||QS:add-to-cart=1874||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 143.202.63.69
country_id: 3469034
description:
143.202.63.69 - - [29/Jun/2026:16:13:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10182765&pdata=https%253A%252F%252Ftdn.tg%252Fboad-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782749609 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/boad-recrute/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.9576.1152 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:143.202.63.69


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 165.101.222.21
country_id: 1210997
description:
165.101.222.21 - - [29/Jun/2026:16:17:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080933&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F29%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782749859 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/29/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.4233.1484 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:165.101.222.21


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.252.241
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.83.252.241||TA:172.83.252.241||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.64.103.80
country_id: 2453866
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seminaire-sur-le-tarif-automobile HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.144.186.167
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.125
country_id: 1880251
description:
47.128.121.125 - - [29/Jun/2026:16:23:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880982&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fparlement-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782750237 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/parlement-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.125


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.136.201.29
country_id: 1210997
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/climat-des-affaires-au-togo-une-lisibilite-accrue-pour-attirer-les-capitaux/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.136.201.29
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/climat-des-affaires-au-togo-une-lisibilite-accrue-pour-attirer-les-capitaux/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun 29 16:27:21 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.167.216
country_id: 2363686
description:
102.64.167.216 - - [29/Jun/2026:16:28:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985113&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14656&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782750530 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14656" "Mozilla/5.0 (Linux; Android 13; en; TECNO CI6 Build/SP1A.210812.016) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.91 HiBrowser/v3.00.03.04;lang=fr;nation=OTHERS;locale=fr_FR UWS/ Mobile Safari/537.36" WL:"0" "com.talpa.hibrowser" XFF:"-" CAPTCHA:"0" PEER:102.64.167.216


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.197
country_id: 6252001
description:
[2026-06-29 16:28:26 +0000] info [cpaneld] 45.38.16.197 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 16:33:27 +0000] info [cpaneld] 129.212.228.74 - wgqhqbem "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.197
country_id: 6252001
description:
[2026-06-29 16:33:01 +0000] info [cpaneld] 45.38.16.197 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.197
country_id: 6252001
description:
[2026-06-29 16:34:33 +0000] info [cpaneld] 45.38.16.197 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 16:35:01 +0000] info [cpaneld] 167.99.236.81 - a.mathey "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 16:36:47 +0000] info [cpaneld] 129.212.228.74 - admin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.23.10
country_id: 1269750
description:
2026-06-29 16:39:16 dovecot_login authenticator failed for H=(fyrWYGNn) [103.127.23.10]:60196: 535 Incorrect authentication data (set_id=aime.d@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.48
country_id: 2395170
description:
197.234.221.48 - - [29/Jun/2026:16:43:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790555&pdata=https%253A%252F%252Flacs1.mairie.tg%252Flacs-1-eau-et-assainissement-le-lions-club-international-dote-les-villages-daname-apeyeme-et-de-gayito-condji-de-latrines-publiques-et-de-forages-deau-potable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782751424 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/lacs-1-eau-et-assainissement-le-lions-club-international-dote-les-villages-daname-apeyeme-et-de-gayito-condji-de-latrines-publiques-et-de-forages-deau-potable/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.234.221.48


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 210.10.11.3
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 210.10.11.3: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.205.86
country_id: 2363686
description:
[2026-06-29 16:47:42 +0000] info [webmaild] 196.168.205.86 - presidence@ucao-uut.tg "POST /cpsess4942500748/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.17.232] != Current IP Address [196.168.205.86]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.214
country_id: 3077311
description:
Jun 29 16:50:47 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.214 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.196.128
country_id: 2658434
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:89.249.196.128||TA:89.249.196.128||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.227.16.140
country_id: 3469034
description:
Jun 29 16:53:18 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.227.16.140 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 16:58:33 +0000] info [cpaneld] 175.100.83.30 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.24.62.245
country_id: 1814991
description:
[2026-06-29 16:59:50 +0000] info [cpaneld] 120.24.62.245 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 45.146.232.84
country_id: 1819730
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.175.150.200
country_id: 298795
description:
[2026-06-29 17:02:13 +0000] info [webmaild] 212.175.150.200 - ccit@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.158
country_id: 2395170
description:
41.79.219.158 - - [29/Jun/2026:17:02:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935556&pdata=https%253A%252F%252Flacs1.mairie.tg%252Flacs-1-eau-et-assainissement-le-lions-club-international-dote-les-villages-daname-apeyeme-et-de-gayito-condji-de-latrines-publiques-et-de-forages-deau-potable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782752562 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/lacs-1-eau-et-assainissement-le-lions-club-international-dote-les-villages-daname-apeyeme-et-de-gayito-condji-de-latrines-publiques-et-de-forages-deau-potable/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [29/Jun/2026:17:04:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053832&pdata=https%253A%252F%252Fwww.ccl.tg%252Fspecialites%252Fvasculaire&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782752647 HTTP/2.0" 302 0 www.ccl.tg "https://www.ccl.tg/specialites/vasculaire" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.31.20.3
country_id: 6252001
description:
[2026-06-29 17:04:36 +0000] info [webmaild] 64.31.20.3 - ymintre@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.39.6
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.38.208.34
country_id: 2510769
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/06/Avis-dappel-public-\xc3\xa0-candidatures-pour-projet-pilote-de-construction-de-centrales-\xc3\xa9lectriques-\xc3\xa0-base-de-la-biomasse-des-d\xc3\xa9chets-municipaux-et-du-so.pdf HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 17:10:00 +0000] info [cpaneld] 175.100.83.30 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 17:13:47 +0000] info [cpaneld] 167.99.236.81 - kwbcfbmo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.185.108.164
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:190.185.108.164||TA:190.185.108.164||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.183
country_id: 1880251
description:
47.128.121.183 - - [29/Jun/2026:17:14:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197651&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fyawovi-agboyibo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782753261 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/yawovi-agboyibo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.183


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.33.80
country_id: 1880251
description:
[2026-06-29 17:15:36 +0000] info [webmaild] 143.244.33.80 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.194.227
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/opera/pizza-opera/new-york/?add-to-cart=2111||QS:add-to-cart=2111||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 17:20:13 +0000] info [cpaneld] 129.212.228.74 - administration "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administration (has_cpuser_file failed)


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 45.90.196.28
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.21||T:APACHE||MVN:ARGS:action||MV:register||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 45.90.196.28
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:99n3749503220||Email:pers.ai.tov.2.2@gmail.com||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.194.98
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/restaurant/osouper/nos-salades/salade-verte/?add-to-cart=3708||QS:add-to-cart=3708||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.99
country_id: 3469034
description:
Jun 29 17:23:19 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.233.158
country_id: 1835841
description:
Jun 29 17:24:51 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.233.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.96.253
country_id: 2363686
description:
[2026-06-29 17:24:51 +0000] info [cpaneld] 196.168.96.253 NEW prbthzuj:Nttbp8Io02X_oi1G address=196.168.96.253,app=cpaneld,creator=prbthzuj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@case-afrique.tg [06/29/2026:17:25:09 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@case-afrique.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.11.161
country_id: 3469034
description:
Jun 29 17:25:32 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.11.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 29 17:25:40 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.145.63
country_id: 2363686
description:
[2026-06-29 17:25:45 +0000] info [webmaild] 196.168.145.63 - kzodji@caissederetraites.tg "POST /cpsess0954280081/3rdparty/roundcube/?_task=mail&_unlock=loading1782753924105&_framed=1 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.136.137] != Current IP Address [196.168.145.63]


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:a08808a6-75ca-4a0d-8506-91b2be709ca2||WPU:yohanes||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.21.73
country_id: 2363686
description:
[2026-06-29 17:27:56 +0000] info [webmaild] 196.169.21.73 - info@case-afrique.tg "POST /cpsess9391455438/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.96.253] != Current IP Address [196.169.21.73]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.196
country_id: 1269750
description:
Jun 29 17:27:15 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 102.64.162.100
country_id: 2363686
description:
[2026-06-29 17:27:30 +0000] info [whostmgrd] 102.64.162.100 NEW root:bnMb7y0TXQymMTo4 address=102.64.162.100,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.162.100
country_id: 2363686
description:
[2026-06-29 17:27:16 +0000] info [whostmgrd] 102.64.162.100 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:b93337ac-e0f5-4310-9ebd-1f6544b9e25e||WPU:yohanes||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.239.153.113
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.239.153.113: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 17:30:03 +0000] info [cpaneld] 167.99.236.81 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.201
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.232.201||TA:45.147.232.201||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.155.31
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:922313283bd0f1ad3e7b55ad3f657bf144e57700||Title:l1z4tsvmdoe734cz7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:11e327855a7c97073d50c56ace12348b934daf5d||Title:x1vh02b5k2n76sfx30||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ebabd6bd98b3dcc2cc36170eb96e3376e64f4ad2||Title:pyf5pz902qz1gv4rw9||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8d1a303b85c6bd94c4b763977add5bacce4839c||Title:94k56uenfcdy1stbz||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 102.64.219.187
country_id: 2363686
domain: brmn.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:admin||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7fdaf10a3c9281da172a1033f9d7fa14cc985a92||Title:8lzgblwhfo3cn5||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b1e04e9af22e825f19e613034d6f1e4025c08e5||Title:stl98o5nq8jw2nt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:39c84cefaef0ed7ebb3c0c1628ed8141b0d33216||Title:zsrziu2orypvkw3||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8c2c2401062a5b7d0ea76631fd4098121482783||Title:aonkmmkvn5zwvcqk6w||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:72aaaea47859345879731af06e2903dddaaf7df2||Title:uoe429ss4mtez1to||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e70cb49a5a550c260a95011b077df1c27082a57||Title:0f8ey4m1ziwpqf||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.205.186.84
country_id: 146669
description:
[2026-06-29 17:41:37 +0000] info [webmaild] 185.205.186.84 - iway@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c69c1b70938a04509888119c1520551c774925f5||Title:v9frqh9lpiluxwpht||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.215.149
country_id: 1880251
domain: pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:34.143.215.149||TA:34.143.215.149||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.155.60.206
country_id: 2300660
description:
[2026-06-29 17:43:12 +0000] info [cpaneld] 41.155.60.206 - togoinrdceh "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:698c2ddfd165a231047ff90a0d59fa2b1156fbbf||Title:zlgis2k3lcrk6jjw7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ddc230e0ada4c4a4557d285f414cbcf318f8edb8||Title:w12lnv0ix09j0cic||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.25.54.78
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/495083354 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.15.61
country_id: 3658394
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-fmi-1108-m-pour-soutenir-les-reformes/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.15.61
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-fmi-1108-m-pour-soutenir-les-reformes/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a6a854d1dbfb689e5e2dcfed0a93b7ee550dc8c3||Title:gtxt0crqbr2x42ysi||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 17:46:22 +0000] info [cpaneld] 129.212.228.74 - pduusmyf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6042d25349693558ea57b010e4c0b2f9cf353f5d||Title:rxm5d88v21gr3p66||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c901dd5b513c00b60233822735c2a439c3d03c26||Title:5h3elndbaw1xbwfv||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 17:47:06 +0000] info [cpaneld] 129.212.228.74 - tiyasuxe "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ca2e17dd29603e31fa513cc6edb881cd0f740fb||Title:t72jgc81zv3tc9||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:271a67d9ad7ee902403fbe2fd18888b44a8a4d70||Title:wsgpi7io3chwi4t||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57fdbf72475564da1e1ba5d5bb219203be9a6170||Title:6lvdmoragxb26ht64||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.203.213.80
country_id: 6252001
description:
[2026-06-29 17:51:04 +0000] info [whostmgrd] 172.203.213.80 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ef6ea9fb404049e1a051e4501b45a9c3ab7a95f||Title:2xkm03d0n8ls00c||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.203.213.80
country_id: 6252001
description:
[2026-06-29 17:51:00 +0000] info [whostmgrd] 172.203.213.80 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.154.40
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6e1152e3017bf6a229f75e826e8d15600fc151e5||Title:gf7bqfqq0wuh5bi||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.169.1.230
country_id: 2363686
description:
196.169.1.230 - - [29/Jun/2026:17:58:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446536&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2026%252F06%252F29%252Fun-meeting-du-cadre-national-de-concertation-pour-le-changement-le-12-juillet-a-vogan%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782755893 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2026/06/29/un-meeting-du-cadre-national-de-concertation-pour-le-changement-le-12-juillet-a-vogan/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.169.1.230


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.113.228
country_id: 2017370
description:
[2026-06-29 17:58:06 +0000] info [cpaneld] 77.222.113.228 - mpqypjjp "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 29 18:01:27 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:05:49 +0000] info [cpaneld] 64.111.92.123 - hini89 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hini89 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.3.206.88
country_id: 1694008
description:
2026-06-29 18:05:32 dovecot_plain authenticator failed for H=(localhost) [122.3.206.88]:8711: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.236
country_id: 6251999
description:
[2026-06-29 18:06:15 +0000] info [cpaneld] 195.63.16.236 - pduusmyf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.198
country_id: 1880251
description:
47.128.112.198 - - [29/Jun/2026:18:06:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777755&pdata=https%253A%252F%252Fmisstogo.tg%252F2023%252F12%252F10%252Fmahjong-titans-in-windows-vista%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782756386 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/2023/12/10/mahjong-titans-in-windows-vista/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.198


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:10:34 +0000] info [cpaneld] 64.111.92.123 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun 29 18:10:05 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77220020
name: IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)
abuser: 150.251.225.28
country_id: 2782113
domain: ucao-uut.tg
description:
IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||MVN:REQUEST_URI||MV:/||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.15.16.102
country_id: 1643084
description:
2026-06-29 18:12:28 dovecot_plain authenticator failed for H=(localhost) [198.15.16.102]:61570: 535 Incorrect authentication data (set_id=contractor@confortis.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 18:12:10 +0000] info [cpaneld] 175.100.83.30 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:13:28 +0000] info [cpaneld] 64.111.92.123 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.6.11.138
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/07/Amadou-Gon-Coulibaly.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:14:58 +0000] info [cpaneld] 64.111.92.123 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.165
country_id: 690791
description:
Jun 29 18:17:26 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 18:19:55 +0000] info [cpaneld] 129.212.228.74 - einguval "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 18:22:48 +0000] info [cpaneld] 167.99.236.81 - crepsad "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.137.177.201
country_id: 3625428
description:
38.137.177.201 - - [29/Jun/2026:18:24:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855314&pdata=https%253A%252F%252Fzephyr.tg%252F9513-2%252Fcadre%252520de%252520coop%2525C3%2525A9ration&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782757465 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/9513-2/cadre%20de%20coop%C3%A9ration" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.137.177.201


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.107.77.107
country_id: 1210997
domain: www.tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tdn.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:25:23 +0000] info [cpaneld] 64.111.92.123 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:27:59 +0000] info [cpaneld] 64.111.92.123 - 2083einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 13.230.21.137
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 13.230.21.137: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 18:35:36 +0000] info [cpaneld] 167.99.236.81 - websitecpanel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-29 18:39:21 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess2780862788/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:39:36 +0000] info [cpaneld] 64.111.92.123 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-29 18:39:20 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.110.215.61
country_id: 1562822
description:
[2026-06-29 18:40:49 +0000] info [webmaild] 116.110.215.61 - ag@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:41:17 +0000] info [cpaneld] 64.111.92.123 - LWS-531391 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user LWS-531391 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 18:43:01 +0000] info [cpaneld] 129.212.228.74 - websitecpanel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:44:05 +0000] info [cpaneld] 64.111.92.123 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 29 18:45:27 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:46:58 +0000] info [cpaneld] 64.111.92.123 - nwjvzxzr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nwjvzxzr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.147
country_id: 3175395
description:
Jun 29 18:49:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.133
country_id: 3469034
description:
Jun 29 18:49:41 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.133
country_id: 3469034
description:
Jun 29 18:49:57 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 18:50:44 +0000] info [cpaneld] 129.212.228.74 - hcbcmrio "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 18:50:46 +0000] info [cpaneld] 64.111.92.123 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 18:51:13 +0000] info [cpaneld] 175.100.83.30 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 155.2.194.77
country_id: 2963597
description:
155.2.194.77 - - [29/Jun/2026:18:52:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908272&pdata=https%253A%252F%252Fwww.hrmbj.mesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782759137 HTTP/2.0" 302 0 www.hrmbj.mesyscom.com "https://www.hrmbj.mesyscom.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:155.2.194.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.210.141.248
country_id: 226074
domain: flp-tg.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89768.flp-tg.com||ServerName:flp-tg.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cbf9293f1df696e13838d591b54c1dc28fecbf1d||Title:0x0384a7f5||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 18:54:44 +0000] info [cpaneld] 167.99.236.81 - bighostingsnbd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.60
country_id: 3017382
description:
[2026-06-29 18:55:27 +0000] info [cpaneld] 51.83.4.60 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 29 18:56:47 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 29 18:57:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.61.246.255
country_id: 3686110
description:
181.61.246.255 - - [29/Jun/2026:18:57:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247465&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmarches-financiers%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782759459 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/marches-financiers/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.8794.1150 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.61.246.255


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-29 18:58:20 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.1.77] != Current IP Address [196.171.58.124]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.29.216
country_id: 2750405
description:
[2026-06-29 18:58:00 +0000] info [cpaneld] 195.63.29.216 - kwbcfbmo "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.210.204.250
country_id: 3017382
description:
185.210.204.250 - - [29/Jun/2026:18:59:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050443&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fle-togo-indifferent-a-la-vague-de-suspension-du-vaccin-astrazeneca%252Fsociete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782759577 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/le-togo-indifferent-a-la-vague-de-suspension-du-vaccin-astrazeneca/societe/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.9255.1953 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.210.204.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.223.247.89
country_id: 6252001
description:
[2026-06-29 18:59:27 +0000] info [whostmgrd] 47.223.247.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.221.11.212
country_id: 6252001
description:
34.221.11.212 - - [29/Jun/2026:19:01:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262171&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782759677 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.221.11.212


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.70.234.240
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.70.234.240||TA:194.70.234.240||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.132.199
country_id: 719819
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/consultants.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:04:45 +0000] info [cpaneld] 64.111.92.123 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.247.207.231
country_id: 6252001
description:
[2026-06-29 19:04:10 +0000] info [whostmgrd] 98.247.207.231 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.252.130
country_id: 3017382
domain: marque.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/marque.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.181.82.56
country_id: 6252001
description:
[2026-06-29 19:05:03 +0000] info [whostmgrd] 64.181.82.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:08:54 +0000] info [cpaneld] 64.111.92.123 - wara.wara.awadi@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 141.51.110.125
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 141.51.110.125: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 19:09:07 +0000] info [cpaneld] 129.212.228.74 - mpqypjjp "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.230.216
country_id: 2750405
description:
[2026-06-29 19:10:11 +0000] info [cpaneld] 146.190.230.216 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.248
country_id: 6252001
description:
Jun 29 19:11:20 ns5 pure-ftpd[1270269]: (?@198.235.24.248) [INFO] New connection from 198.235.24.248


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.9
country_id: 1643084
description:
[2026-06-29 19:13:23 +0000] info [whostmgrd] 172.111.157.9 - stephanetg "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:14:46 +0000] info [cpaneld] 64.111.92.123 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.70.147.66
country_id: 2542007
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/40e-assemblee-generale-de-la-carte-brune-a-lome HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.9
country_id: 1643084
description:
[2026-06-29 19:15:47 +0000] info [whostmgrd] 172.111.157.9 - test1 "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 29 19:15:18 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.21.181
country_id: 2363686
description:
[2026-06-29 19:16:13 +0000] info [webmaild] 196.169.21.181 - wiyao.g@inger.tg "GET /cpsess1903941650/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.31.180] != Current IP Address [196.169.21.181]


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 170.106.109.250
country_id: 6252001
domain: www.hotelyabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.159 Safari/537.36||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 151.0.2.1
country_id: 690791
description:
Denial of Service (DoS) attack was discovered from 151.0.2.1: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.202
country_id: 3175395
description:
Jun 29 19:19:34 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:20:25 +0000] info [cpaneld] 64.111.92.123 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.165.22
country_id: 2363686
description:
[2026-06-29 19:20:42 +0000] info [webmaild] 102.64.165.22 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.165.22
country_id: 2363686
description:
[2026-06-29 19:21:00 +0000] info [webmaild] 102.64.165.22 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.196.138
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/telephones-2/infinix/infinix-zero-5-pro/?add-to-cart=2346||QS:add-to-cart=2346||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:23:02 +0000] info [cpaneld] 64.111.92.123 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.48.242.174
country_id: 357994
domain: 24heureinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/24heureinfo.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:26:00 +0000] info [cpaneld] 64.111.92.123 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.138
country_id: 1880251
description:
47.128.121.138 - - [29/Jun/2026:19:26:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12739731&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Finvestir-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782761172 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/investir-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.194.70.164
country_id: 6252001
description:
[2026-06-29 19:29:41 +0000] info [whostmgrd] 98.194.70.164 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.221.11.212
country_id: 6252001
description:
34.221.11.212 - - [29/Jun/2026:19:31:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001608&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Ff3a3020310434ecafac47d1a395dcd36%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782761505 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/f3a3020310434ecafac47d1a395dcd36/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.221.11.212


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.41.7
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/protection-de-lenfant-les-avancees-faites-en-2025/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.85.2.92
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/region-maritime-zio-affiche-des-indicateurs-sanitaires-en-forte-progression/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.85.2.92
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/region-maritime-zio-affiche-des-indicateurs-sanitaires-en-forte-progression/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:34:31 +0000] info [cpaneld] 64.111.92.123 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.14.170.15
country_id: 1814991
description:
[2026-06-29 19:36:13 +0000] info [cpaneld] 106.14.170.15 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.13
country_id: 2395170
description:
197.234.221.13 - - [29/Jun/2026:19:38:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934482&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-tvm-application-mobile%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782761905 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-tvm-application-mobile/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.234.221.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.128.84.224
country_id: 1835841
description:
Jun 29 19:39:47 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.128.84.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-06-29 19:39:49 dovecot_login authenticator failed for H=([175.203.199.118]) [121.128.84.224]:56000: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 19:41:06 +0000] info [cpaneld] 64.111.92.123 - enadamso|@ "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.72.241.167
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.72.241.167||TA:185.72.241.167||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.193.125
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:89.249.193.125||TA:89.249.193.125||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.20.212.113
country_id: 241170
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:178.20.212.113||TA:178.20.212.113||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.254.161
country_id: 3017382
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:148.135.254.161||TA:148.135.254.161||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.27.86
country_id: 226074
description:
Jun 29 19:45:42 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.27.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.51.56.113
country_id: 6252001
description:
[2026-06-29 19:51:29 +0000] info [whostmgrd] 136.51.56.113 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 19:51:35 +0000] info [cpaneld] 175.100.83.30 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.195.114.169
country_id: 6252001
description:
Jun 29 19:53:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.195.114.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.222.131
country_id: 2363686
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/index.php/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.243.14.160
country_id: 3469034
domain: www.cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cfpj.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.243.14.160
country_id: 3469034
domain: www.cfpj.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cfpj.tghttp/www.cfpj.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 19:55:43 +0000] info [cpaneld] 129.212.228.74 - mouss "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.242.20
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/33.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.217.186
country_id: 2363686
description:
[2026-06-29 19:58:00 +0000] info [webmaild] 196.168.217.186 - wiyao.g@inger.tg "POST /cpsess1903941650/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.21.181] != Current IP Address [196.168.217.186]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.221.11.212
country_id: 6252001
description:
34.221.11.212 - - [29/Jun/2026:19:58:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065558&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782763102 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.221.11.212


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.251.130.17
country_id: 2542007
description:
41.251.130.17 - - [29/Jun/2026:19:58:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987113&pdata=https%253A%252F%252Fwww.snb.tg%252Ffr%252Fold%252Fevents%252F5&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782763087 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/fr/old/events/5" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.4031.1310 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.251.130.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.128.75.249
country_id: 1880251
description:
43.128.75.249 - - [29/Jun/2026:20:00:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9686115&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-accompagnement-constant-des-jeunes-et-femmes-entrepreneurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782763250 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-accompagnement-constant-des-jeunes-et-femmes-entrepreneurs/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.128.75.249


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.52.240
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/gbagba-2023-apotheose HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.221.11.212
country_id: 6252001
description:
34.221.11.212 - - [29/Jun/2026:20:08:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722402&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782763721 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.221.11.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.151.60
country_id: 6252001
description:
[2026-06-29 20:10:26 +0000] info [cpaneld] 47.158.151.60 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.233.137.21
country_id: 6252001
description:
[2026-06-29 20:10:32 +0000] info [cpaneld] 67.233.137.21 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.1.127.122
country_id: 6252001
description:
[2026-06-29 20:10:43 +0000] info [cpaneld] 100.1.127.122 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.14.132.246
country_id: 6252001
description:
[2026-06-29 20:10:35 +0000] info [cpaneld] 100.14.132.246 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.171.18
country_id: 6252001
description:
[2026-06-29 20:10:46 +0000] info [cpaneld] 172.59.171.18 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.196.61.120
country_id: 6252001
description:
[2026-06-29 20:10:20 +0000] info [cpaneld] 74.196.61.120 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.163.93.61
country_id: 6252001
description:
[2026-06-29 20:10:22 +0000] info [cpaneld] 174.163.93.61 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.253.85.110
country_id: 6252001
description:
[2026-06-29 20:10:39 +0000] info [cpaneld] 96.253.85.110 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.15.237.67
country_id: 6252001
description:
[2026-06-29 20:13:06 +0000] info [cpaneld] 38.15.237.67 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.208.93.101
country_id: 6252001
description:
[2026-06-29 20:13:12 +0000] info [cpaneld] 71.208.93.101 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.159.180.32
country_id: 6252001
description:
[2026-06-29 20:13:22 +0000] info [cpaneld] 38.159.180.32 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.197.228.115
country_id: 6252001
description:
[2026-06-29 20:13:25 +0000] info [cpaneld] 68.197.228.115 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.28.182
country_id: 6252001
description:
[2026-06-29 20:13:03 +0000] info [cpaneld] 172.59.28.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:13:06 +0000] info [cpaneld] 64.111.92.123 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 20:15:43 +0000] info [cpaneld] 167.99.236.81 - a.mathey "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.180
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=la&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:19:04 +0000] info [cpaneld] 64.111.92.123 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.180
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lacs1.mair&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:21:20 +0000] info [cpaneld] 64.111.92.123 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.176.166
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/static_block/shop-bottom-jumbotron/?add-to-cart=8172||QS:add-to-cart=8172||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.101.95
country_id: 3469034
description:
Jun 29 20:26:37 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.101.95 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [29/Jun/2026:20:27:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182437&pdata=http%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782764829 HTTP/1.1" 302 0 cfpj.tg "http://cfpj.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 121.121.56.43
country_id: 1733045
description:
121.121.56.43 - - [29/Jun/2026:20:28:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950122&pdata=https%253A%252F%252Fcpanel.express.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782764889 HTTP/2.0" 302 0 cpanel.express.free.netmaster.tg "https://cpanel.express.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:121.121.56.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:30:22 +0000] info [cpaneld] 64.111.92.123 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.234.175
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.234.175||TA:45.147.234.175||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.231.89.218
country_id: 2077456
description:
[2026-06-29 20:33:24 +0000] info [webmaild] 103.231.89.218 - kagbam@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.182.171.161
country_id: 6252001
description:
Jun 29 20:34:25 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.182.171.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.129.152.196
country_id: 6252001
description:
[2026-06-29 20:37:52 +0000] info [cpaneld] 102.129.152.196 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.84.194.80
country_id: 6252001
description:
[2026-06-29 20:37:54 +0000] info [cpaneld] 67.84.194.80 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.57.226.194
country_id: 6252001
description:
[2026-06-29 20:38:04 +0000] info [cpaneld] 71.57.226.194 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.79.34.226
country_id: 6252001
description:
[2026-06-29 20:38:08 +0000] info [cpaneld] 72.79.34.226 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.191.239
country_id: 6252001
description:
[2026-06-29 20:38:15 +0000] info [cpaneld] 172.59.191.239 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.27.46.250
country_id: 6252001
description:
[2026-06-29 20:37:58 +0000] info [cpaneld] 50.27.46.250 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.127.130.17
country_id: 6252001
description:
[2026-06-29 20:38:11 +0000] info [cpaneld] 24.127.130.17 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.101.59.88
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.101.59.88: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.113.170
country_id: 6252001
description:
[2026-06-29 20:43:03 +0000] info [cpaneld] 23.243.113.170 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.41.246.173
country_id: 6252001
description:
[2026-06-29 20:43:06 +0000] info [cpaneld] 108.41.246.173 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.65.107.242
country_id: 6252001
description:
[2026-06-29 20:43:01 +0000] info [cpaneld] 72.65.107.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.131.239
country_id: 6252001
description:
[2026-06-29 20:43:23 +0000] info [cpaneld] 76.32.131.239 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 20:43:10 +0000] info [cpaneld] 129.212.228.74 - masfloy "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.100.80
country_id: 6252001
description:
[2026-06-29 20:43:20 +0000] info [cpaneld] 35.151.100.80 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.16.8.193
country_id: 6252001
description:
[2026-06-29 20:43:08 +0000] info [cpaneld] 98.16.8.193 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.217.78
country_id: 6252001
description:
[2026-06-29 20:43:12 +0000] info [cpaneld] 74.132.217.78 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.80.66.235
country_id: 6252001
description:
[2026-06-29 20:43:14 +0000] info [cpaneld] 50.80.66.235 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.127.159.64
country_id: 6252001
description:
[2026-06-29 20:43:17 +0000] info [cpaneld] 71.127.159.64 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:44:23 +0000] info [cpaneld] 64.111.92.123 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:45:13 +0000] info [cpaneld] 64.111.92.123 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-29 20:46:14 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.230.255.116
country_id: 6252001
description:
[2026-06-29 20:47:11 +0000] info [cpaneld] 47.230.255.116 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.158.153.175
country_id: 6252001
description:
[2026-06-29 20:47:15 +0000] info [cpaneld] 24.158.153.175 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.76
country_id: 3865483
description:
Jun 29 20:47:26 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.7.166.55
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/9eme-forum-des-marches-dassurances HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 20:47:55 +0000] info [cpaneld] 175.100.83.30 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.191.73
country_id: 6252001
description:
[2026-06-29 20:47:09 +0000] info [cpaneld] 174.63.191.73 - cfmi "GET /login/?login_only=1&user=cfmi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.40.121.166
country_id: 6252001
description:
[2026-06-29 20:47:13 +0000] info [cpaneld] 70.40.121.166 - cfm "GET /login/?login_only=1&user=cfm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfm (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.99.20
country_id: 3996063
description:
Jun 29 20:48:40 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.99.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:49:04 +0000] info [cpaneld] 64.111.92.123 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.223
country_id: 6252001
description:
Jun 29 20:50:02 ns5 pure-ftpd[1313029]: (?@198.235.24.223) [INFO] New connection from 198.235.24.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.155
country_id: 3865483
description:
Jun 29 20:51:27 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.155 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [29/Jun/2026:20:51:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949139&pdata=https%253A%252F%252Fwww.dagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782766309 HTTP/2.0" 302 0 www.dagl.tg "https://www.dagl.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [29/Jun/2026:20:52:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079962&pdata=https%253A%252F%252Fwww.dagl.tg%252Faccueil%252F11-cabinet-du-gouverneur&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782766338 HTTP/2.0" 302 0 www.dagl.tg "https://www.dagl.tg/accueil/11-cabinet-du-gouverneur" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.151.80
country_id: 6252001
description:
[2026-06-29 20:52:51 +0000] info [cpaneld] 172.56.151.80 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.13.185.171
country_id: 6252001
description:
[2026-06-29 20:52:44 +0000] info [cpaneld] 73.13.185.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.135.97
country_id: 3895114
description:
[2026-06-29 20:53:08 +0000] info [cpaneld] 181.42.135.97 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.36.213.202
country_id: 3469034
description:
[2026-06-29 20:53:17 +0000] info [cpaneld] 177.36.213.202 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.224.26.107
country_id: 6252001
description:
[2026-06-29 20:53:15 +0000] info [cpaneld] 96.224.26.107 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.86.110.185
country_id: 3686110
description:
[2026-06-29 20:53:02 +0000] info [cpaneld] 186.86.110.185 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.37.134.80
country_id: 2017370
description:
[2026-06-29 20:53:05 +0000] info [cpaneld] 92.37.134.80 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.87.174.243
country_id: 6252001
description:
[2026-06-29 20:53:13 +0000] info [cpaneld] 67.87.174.243 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.54.185.182
country_id: 3469034
description:
[2026-06-29 20:53:24 +0000] info [cpaneld] 179.54.185.182 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.130.160.252
country_id: 2802361
description:
[2026-06-29 20:53:25 +0000] info [cpaneld] 109.130.160.252 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.238.121.69
country_id: 6252001
description:
[2026-06-29 20:53:09 +0000] info [cpaneld] 98.238.121.69 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.92.60
country_id: 6252001
description:
[2026-06-29 20:53:18 +0000] info [cpaneld] 71.191.92.60 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 20:53:53 +0000] info [cpaneld] 64.111.92.123 - iaideveloppementgroupe@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.97.233.106
country_id: 3625428
description:
[2026-06-29 20:53:00 +0000] info [cpaneld] 190.97.233.106 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.155.131.91
country_id: 3686110
description:
[2026-06-29 20:53:11 +0000] info [cpaneld] 186.155.131.91 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.128.26
country_id: 6252001
description:
[2026-06-29 20:53:04 +0000] info [cpaneld] 152.86.128.26 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.146.17.250
country_id: 3996063
description:
[2026-06-29 20:53:14 +0000] info [cpaneld] 189.146.17.250 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.2.137
country_id: 6252001
description:
[2026-06-29 20:52:59 +0000] info [cpaneld] 73.205.2.137 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.229.206.190
country_id: 6252001
description:
[2026-06-29 20:53:02 +0000] info [cpaneld] 71.229.206.190 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 38.76.247.78
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 38.76.247.78: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.179.203.145
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 213.179.203.145: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.20.236
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 74.63.20.236: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.179.203.132
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 213.179.203.132: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.231.41.187
country_id: 690791
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.179.203.133
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 213.179.203.133: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.179.203.139
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 213.179.203.139: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.231.41.187
country_id: 690791
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.20.244
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 74.63.20.244: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.20.246
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 74.63.20.246: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.179.203.144
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 213.179.203.144: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.20.238
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 74.63.20.238: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.20.245
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 74.63.20.245: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.33.24
country_id: 1831722
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/73.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.179.203.138
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 213.179.203.138: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.20.237
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 74.63.20.237: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.65.157
country_id: 1562822
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.65.157
country_id: 1562822
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-06-29 20:59:12 dovecot_login authenticator failed for H=([178.176.229.202]) [197.231.202.201]:34101: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.42
country_id: 3469034
description:
Jun 29 20:59:40 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.242.134.57
country_id: 298795
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/france-les-etrangers-polygames-bientot-expulses/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.242.134.57
country_id: 298795
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/france-les-etrangers-polygames-bientot-expulses/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.202.201
country_id: 51537
description:
Jun 29 20:59:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.202.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.115.182.236
country_id: 6252001
description:
[2026-06-29 21:02:09 +0000] info [cpaneld] 24.115.182.236 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.55.136.235
country_id: 6252001
description:
[2026-06-29 21:02:14 +0000] info [cpaneld] 73.55.136.235 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.144.138
country_id: 6252001
description:
[2026-06-29 21:02:07 +0000] info [cpaneld] 76.136.144.138 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.176.60.59
country_id: 6252001
description:
[2026-06-29 21:02:04 +0000] info [cpaneld] 75.176.60.59 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.21.213
country_id: 6252001
description:
[2026-06-29 21:02:16 +0000] info [cpaneld] 108.53.21.213 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.119.203.75
country_id: 6252001
description:
[2026-06-29 21:02:19 +0000] info [cpaneld] 68.119.203.75 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 21:04:02 +0000] info [cpaneld] 64.111.92.123 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.2
country_id: 1880251
description:
43.173.179.2 - - [29/Jun/2026:21:04:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670184&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Fdebut-des-epreuves-du-bts%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782767085 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/education/debut-des-epreuves-du-bts/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.74.41
country_id: 1527747
description:
Jun 29 21:04:26 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.74.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-06-29 21:04:28 dovecot_login authenticator failed for H=([218.92.251.198]) [92.62.74.41]:42054: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-29 21:04:00 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:56342: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-29 21:06:00 +0000] info [cpaneld] 51.83.4.64 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anadebfreenetmas (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [29/Jun/2026:21:06:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12895843&pdata=http%253A%252F%252Fmail.marketplace.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782767182 HTTP/1.1" 302 0 mail.marketplace.netmaster.tg "http://mail.marketplace.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 21:07:25 +0000] info [cpaneld] 129.212.228.74 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 21:08:19 +0000] info [cpaneld] 64.111.92.123 - .SAPHYRTOUR "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.194
country_id: 933860
description:
Jun 29 21:09:43 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.101.34
country_id: 798544
description:
Jun 29 21:10:55 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.101.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.45
country_id: 6252001
description:
205.169.39.45 - - [29/Jun/2026:21:10:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645360&pdata=http%253A%252F%252Fwebmail.marketplace.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782767448 HTTP/1.1" 302 0 webmail.marketplace.netmaster.tg "http://webmail.marketplace.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.45


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.179.161
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/wingsn-shake/nos-entrees/salade-verte/?add-to-cart=1949||QS:add-to-cart=1949||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.101.34
country_id: 798544
description:
Jun 29 21:11:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.101.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 21:13:28 +0000] info [cpaneld] 175.100.83.30 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.79.150.207
country_id: 6252001
description:
[2026-06-29 21:13:10 +0000] info [cpaneld] 45.79.150.207 NEW wcnyaruu:vDqjjF3PoD9ZcCxx address=45.79.150.207,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 21:14:08 +0000] info [cpaneld] 64.111.92.123 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.121.236.131
country_id: 3625428
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/troisieme-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.111.110
country_id: 1269750
description:
Jun 29 21:16:20 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.111.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-06-29 21:16:22 dovecot_login authenticator failed for H=(111-70-23-239.emome-ip.hinet.net) [27.123.111.110]:43138: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.236.239.60
country_id: 6252001
description:
[2026-06-29 21:17:44 +0000] info [cpaneld] 172.236.239.60 NEW wcnyaruu:NsBaOKmTzxvptnqA address=172.236.239.60,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.184
country_id: 3175395
description:
Jun 29 21:18:51 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.213
country_id: 3865483
description:
Jun 29 21:19:34 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.184
country_id: 3175395
description:
Jun 29 21:18:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-29 21:21:49 +0000] info [cpaneld] 129.212.228.74 - conseiller "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.71.26.110
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/la-snb-bien-presente-aux-gnadoe-magazine-awards HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.39.240.133
country_id: 953987
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:196.39.240.133||TA:196.39.240.133||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.1
country_id: 3469034
description:
Jun 29 21:28:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.1 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.139.7.211
country_id: 458258
description:
[2026-06-29 21:27:58 +0000] info [cpaneld] 90.139.7.211 - ifxmoxbf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.84.192.134
country_id: 6252001
description:
[2026-06-29 21:31:42 +0000] info [whostmgrd] 174.84.192.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.147.57.182
country_id: 2750405
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.105.202.136
country_id: 3277605
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 21:36:10 +0000] info [cpaneld] 64.111.92.123 - oegrazwu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user oegrazwu (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.105.202.136
country_id: 3277605
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.83.30
country_id: 1831722
description:
[2026-06-29 21:37:53 +0000] info [cpaneld] 175.100.83.30 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.59.178.128
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-zlecaf-salue-la-decision-du-togo-sur-la-libre-circulation-des-africains/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.59.178.128
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-zlecaf-salue-la-decision-du-togo-sur-la-libre-circulation-des-africains/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2026-06-29 21:44:04 dovecot_login authenticator failed for H=([183.171.47.32]) [195.222.57.190]:55780: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Jun 29 21:44:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 21:45:27 +0000] info [cpaneld] 64.111.92.123 - iaideveloppementgroupe@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.141.128.144
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.141.128.144||TA:45.141.128.144||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.206.108
country_id: 99237
description:
[2026-06-29 21:51:10 +0000] info [cpaneld] 185.187.206.108 - arsetg "GET /login/?login_only=1&user=arsetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.191.59.166
country_id: 3996063
description:
[2026-06-29 21:51:02 +0000] info [cpaneld] 187.191.59.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.123.207.74
country_id: 3437598
description:
[2026-06-29 21:51:07 +0000] info [cpaneld] 181.123.207.74 - arse "GET /login/?login_only=1&user=arse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.101.239.202
country_id: 99237
description:
[2026-06-29 21:51:15 +0000] info [cpaneld] 185.101.239.202 - ars "GET /login/?login_only=1&user=ars&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ars (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.74.110
country_id: 3895114
description:
[2026-06-29 21:51:20 +0000] info [cpaneld] 179.60.74.110 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-06-29 21:52:20 dovecot_login authenticator failed for H=([95.165.142.8]) [101.13.4.124]:55292: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.124
country_id: 1668284
description:
Jun 29 21:52:18 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.124 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
country_id: 1880251
description:
47.128.121.174 - - [29/Jun/2026:21:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001821&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Faccident%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782770039 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/accident/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 21:53:59 +0000] info [cpaneld] 64.111.92.123 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 21:55:40 +0000] info [cpaneld] 167.99.236.81 - dev03 "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 21:55:32 +0000] info [cpaneld] 64.111.92.123 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 147.90.234.88
country_id: 6252001
description:
147.90.234.88 - cafeitadm [29/Jun/2026:22:06:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081542&pdata=https%253A%252F%252Fcafeit.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782770762 HTTP/2.0" 302 0 cafeit.tg "https://cafeit.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:147.90.234.88


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.197.181
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/flash-disk-drive/pen-drive/?add-to-cart=43||QS:add-to-cart=43||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.177.2
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/pizzavi/pizza-pizzavi/speciale/?add-to-cart=2003||QS:add-to-cart=2003||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 22:10:02 +0000] info [cpaneld] 167.99.236.81 - administration "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administration (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [29/Jun/2026:22:10:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947499&pdata=https%253A%252F%252Fciieeinternational.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782771048 HTTP/2.0" 302 0 ciieeinternational.org "https://ciieeinternational.org/" "Mozilla/5.0 (Linux; Android 13; 22111317PG Build/TKQ1.221114.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023108040 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.8.4 ByteLocale/pt ByteFullLocale/pt Region/BR AppId/1233 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 102.206.156.109
country_id: 203312
domain: ciieeinternational.org
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 musical_ly_40.7.0 BytedanceWebview/d8a21c6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: ciieeinternational.org
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; 22111317PG Build/TKQ1.221114.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023108040 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.8.4 ByteLocale/pt ByteFullLocale/pt Region/BR AppId/1233 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 151.123.177.225
country_id: 3017382
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:cfpjusti||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.196.83
country_id: 3469034
description:
Jun 29 22:13:41 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.196.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 22:12:58 +0000] info [cpaneld] 64.111.92.123 - concours "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.230
country_id: 1269750
description:
Jun 29 22:13:03 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 209.50.188.206
country_id: 6251999
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:cfpjusti||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-29 22:16:40 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:58776: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.207
country_id: 1880251
description:
43.172.196.207 - - [29/Jun/2026:22:19:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854805&pdata=https%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782771558 HTTP/1.1" 404 561 dagl.tg "https://dagl.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.207


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-06-29 22:22:18 +0000] info [cpaneld] 66.116.242.211 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.255.179.245
country_id: 3576396
description:
[2026-06-29 22:23:52 +0000] info [cpaneld] 104.255.179.245 - kidsedunetmaster "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 22:24:03 +0000] info [cpaneld] 64.111.92.123 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.129.121.39
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/IMG-20220924-WA0230.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 22:26:12 +0000] info [cpaneld] 167.99.236.81 - togoinrdceh "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.244
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.244: 80 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.236.147.255
country_id: 1880251
description:
Jun 29 22:28:37 ns5 pure-ftpd[1354228]: (?@47.236.147.255) [INFO] New connection from 47.236.147.255


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-29 22:30:24 +0000] info [cpaneld] 51.83.5.75 - cafeitadm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 22:30:38 +0000] info [cpaneld] 64.111.92.123 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.39
country_id: 1643084
description:
[2026-06-29 22:33:21 +0000] info [cpaneld] 157.66.56.39 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-06-29 22:34:25 dovecot_login authenticator failed for H=(ol182-153.fibertel.com.ar) [109.233.21.109]:51752: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Jun 29 22:34:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.126.215.120
country_id: 1835841
description:
Jun 29 22:34:16 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.126.215.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-06-29 22:34:18 dovecot_login authenticator failed for H=(138-121-202-90.static.hostdime.com) [220.126.215.120]:35522: 535 Incorrect authentication data (set_id=sales@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.128.63
country_id: 690791
description:
Jun 29 22:35:14 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.128.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.26
country_id: 3469034
description:
Jun 29 22:35:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.196.185
country_id: 2017370
description:
2026-06-29 22:36:29 dovecot_login authenticator failed for H=([184.185.2.1]) [92.255.196.185]:50256: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.109.9.213
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 65.109.9.213: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.65.225.68
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afreximbank-gcr-confirme-la-notation-a-a2-avec-perspective-stable/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.142.141
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/afreximbank-gcr-confirme-la-notation-a-a2-avec-perspective-stable/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-06-29 22:40:37 dovecot_login authenticator failed for H=([63.135.169.175]) [128.185.12.179]:55226: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
country_id: 1269750
description:
Jun 29 22:40:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.255.199.99
country_id: 6252001
domain: 52.13.103.236
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/52.13.103.236/azenv.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.155.5.88
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/Purs_Faure-860x645-1-300x225.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-06-29 22:53:36 dovecot_login authenticator failed for H=([60.173.105.206]) [89.218.247.234]:55612: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.218.247.234
country_id: 1522867
description:
Jun 29 22:53:34 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.218.247.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 22:56:06 +0000] info [cpaneld] 167.99.236.81 - admin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.178.227.0
country_id: 3469034
description:
Jun 29 22:57:06 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.178.227.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.178.227.0
country_id: 3469034
description:
2026-06-29 22:57:08 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [45.178.227.0]:44811: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.204.232.244
country_id: 1269750
description:
Jun 29 22:57:18 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.204.232.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-06-29 22:57:20 dovecot_login authenticator failed for H=(static-200-58-83-79.supernet.com.bo) [49.204.232.244]:45954: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-29 22:58:37 +0000] info [cpaneld] 167.99.236.81 - aifkjzqm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.255.199.99
country_id: 6252001
domain: 54.187.209.101
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/54.187.209.101/azenv2.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.45.51
country_id: 6252001
description:
[2026-06-29 22:59:36 +0000] info [cpaneld] 104.32.45.51 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.244.135.85
country_id: 6252001
description:
[2026-06-29 22:59:46 +0000] info [cpaneld] 71.244.135.85 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.228.49.170
country_id: 6252001
description:
[2026-06-29 22:59:48 +0000] info [cpaneld] 129.228.49.170 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.30.96.20
country_id: 6252001
description:
[2026-06-29 22:59:51 +0000] info [cpaneld] 64.30.96.20 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.147.161.103
country_id: 6252001
description:
[2026-06-29 22:59:43 +0000] info [cpaneld] 67.147.161.103 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.184.75
country_id: 3437598
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-officiel-djama-lager HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.171.35
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:140.235.171.35||TA:140.235.171.35||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.7
country_id: 3469034
description:
Jun 29 23:03:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.237.253
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.180.237.253||TA:194.180.237.253||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:06:49 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:06:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36432: 535 Incorrect authentication data (set_id=og@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:06:31 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:06:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34294: 535 Incorrect authentication data (set_id=cbc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:06:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25094: 535 Incorrect authentication data (set_id=srvc33@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:06:29 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:06:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58648: 535 Incorrect authentication data (set_id=sameh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.90.17
country_id: 3865483
description:
Jun 29 23:07:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:07:19 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:07:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1238: 535 Incorrect authentication data (set_id=oud@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:06:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63534: 535 Incorrect authentication data (set_id=assembly@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:07:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12618: 535 Incorrect authentication data (set_id=cn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:07:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10476: 535 Incorrect authentication data (set_id=brain@ns5.netmaster.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.182.250
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/store/seduction/?add-to-cart=9754||QS:add-to-cart=9754||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:07:37 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:07:18 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:08:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51202: 535 Incorrect authentication data (set_id=araki@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:08:28 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.167
country_id: 1880251
description:
43.173.174.167 - - [29/Jun/2026:23:08:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802906&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F19668&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782774507 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/19668" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:08:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41898: 535 Incorrect authentication data (set_id=archibald@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:08:06 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:08:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10646: 535 Incorrect authentication data (set_id=qwertyuiop@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:07:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53338: 535 Incorrect authentication data (set_id=shenji@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:08:08 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:09:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18234: 535 Incorrect authentication data (set_id=npanag@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:09:20 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:09:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47274: 535 Incorrect authentication data (set_id=prelude1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:09:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51096: 535 Incorrect authentication data (set_id=ban@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:09:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23522: 535 Incorrect authentication data (set_id=batiment@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:09:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17844: 535 Incorrect authentication data (set_id=nodered@ns5.netmaster.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.176.78
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/wingsn-shake/nos-sandwichs/bacon-egg-burger/?add-to-cart=1944||QS:add-to-cart=1944||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:08:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:08:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:10:22 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:10:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44252: 535 Incorrect authentication data (set_id=odeon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:10:07 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:10:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54984: 535 Incorrect authentication data (set_id=rajesh@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:10:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50722: 535 Incorrect authentication data (set_id=chung@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:10:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:10:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27066: 535 Incorrect authentication data (set_id=stest@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:11:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31166: 535 Incorrect authentication data (set_id=orderbydate@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:11:07 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:11:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:11:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20400: 535 Incorrect authentication data (set_id=fish@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.121
country_id: 3469034
description:
Jun 29 23:11:17 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:11:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3140: 535 Incorrect authentication data (set_id=wpdemo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:10:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:10:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27022: 535 Incorrect authentication data (set_id=vm5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.55
country_id: 798544
description:
Jun 29 23:12:07 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:12:25 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:11:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61118: 535 Incorrect authentication data (set_id=soluciones@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:11:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:12:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47714: 535 Incorrect authentication data (set_id=raedisch@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:12:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52246: 535 Incorrect authentication data (set_id=r2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:11:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:12:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48570: 535 Incorrect authentication data (set_id=recrutement@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:12:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:13:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:13:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28510: 535 Incorrect authentication data (set_id=ww5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:13:26 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:13:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33478: 535 Incorrect authentication data (set_id=lucc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:13:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28432: 535 Incorrect authentication data (set_id=medoc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.184.13
country_id: 1814991
description:
Jun 29 23:13:09 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.184.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:13:37 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:13:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60428: 535 Incorrect authentication data (set_id=hsc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.184.13
country_id: 1814991
description:
2026-06-29 23:13:11 dovecot_login authenticator failed for H=([218.95.124.232]) [27.188.184.13]:58806: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:13:18 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:13:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20468: 535 Incorrect authentication data (set_id=medoc@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.67.60
country_id: 2802361
description:
158.173.67.60 - - [29/Jun/2026:23:13:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039597&pdata=https%253A%252F%252Fwww.voozanoo.pnls.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782774815 HTTP/2.0" 302 0 www.voozanoo.pnls.tg "https://www.voozanoo.pnls.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.67.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:14:08 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:14:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61236: 535 Incorrect authentication data (set_id=younes@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:14:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4806: 535 Incorrect authentication data (set_id=cable@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:14:12 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:14:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54156: 535 Incorrect authentication data (set_id=nicolas@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:14:30 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:14:06 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:14:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36614: 535 Incorrect authentication data (set_id=redash@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:15:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12772: 535 Incorrect authentication data (set_id=liesenbe@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:14:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37684: 535 Incorrect authentication data (set_id=watanabe@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:14:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:15:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30248: 535 Incorrect authentication data (set_id=mc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:15:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:15:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:15:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45560: 535 Incorrect authentication data (set_id=t7@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:16:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2542: 535 Incorrect authentication data (set_id=mssql4@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:16:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15596: 535 Incorrect authentication data (set_id=tl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:16:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17950: 535 Incorrect authentication data (set_id=domain@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:16:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53368: 535 Incorrect authentication data (set_id=samples@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:15:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:16:11 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:16:16 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:15:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:16:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58230: 535 Incorrect authentication data (set_id=skoda@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:17:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38976: 535 Incorrect authentication data (set_id=warning@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:17:06 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:17:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58766: 535 Incorrect authentication data (set_id=diageo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:17:11 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:17:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29556: 535 Incorrect authentication data (set_id=bn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:17:14 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:17:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23196: 535 Incorrect authentication data (set_id=suai@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:17:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:18:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35124: 535 Incorrect authentication data (set_id=rostov-na-donu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:18:04 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:18:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:18:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:18:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63856: 535 Incorrect authentication data (set_id=temp14@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:18:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5780: 535 Incorrect authentication data (set_id=phoenix@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:18:08 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:18:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7342: 535 Incorrect authentication data (set_id=martin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:19:32 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:19:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27862: 535 Incorrect authentication data (set_id=kodi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:19:13 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:19:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56444: 535 Incorrect authentication data (set_id=bbs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:19:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16252: 535 Incorrect authentication data (set_id=m.jp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:18:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:18:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46478: 535 Incorrect authentication data (set_id=domcontrol@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:19:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.177.103.130
country_id: 6252001
domain: brmn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:181.177.103.130||TA:181.177.103.130||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:19:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27620: 535 Incorrect authentication data (set_id=abramov@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:20:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56930: 535 Incorrect authentication data (set_id=hush@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:19:56 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:20:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:20:22 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:20:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4078: 535 Incorrect authentication data (set_id=diabet@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:20:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:8532: 535 Incorrect authentication data (set_id=diabet@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:20:21 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:20:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32898: 535 Incorrect authentication data (set_id=electrical@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:21:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39550: 535 Incorrect authentication data (set_id=gast2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:21:03 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:21:11 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:21:07 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:21:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33258: 535 Incorrect authentication data (set_id=trixbox@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:21:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9202: 535 Incorrect authentication data (set_id=tax@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:21:29 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:21:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49286: 535 Incorrect authentication data (set_id=vasco@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:21:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18680: 535 Incorrect authentication data (set_id=top@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:22:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50070: 535 Incorrect authentication data (set_id=man5@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:22:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17622: 535 Incorrect authentication data (set_id=effortless@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:22:36 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:22:03 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:22:09 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:22:16 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:22:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15692: 535 Incorrect authentication data (set_id=btp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:22:57 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:22:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58534: 535 Incorrect authentication data (set_id=hal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:23:06 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:23:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56322: 535 Incorrect authentication data (set_id=elina@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:23:07 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:23:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4962: 535 Incorrect authentication data (set_id=planning@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:23:20 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:23:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26328: 535 Incorrect authentication data (set_id=eng@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:23:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46332: 535 Incorrect authentication data (set_id=eng@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:24:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37280: 535 Incorrect authentication data (set_id=wis@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:24:04 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:24:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2396: 535 Incorrect authentication data (set_id=natalija@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:23:57 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:23:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:24:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:23:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45626: 535 Incorrect authentication data (set_id=exch@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:24:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14532: 535 Incorrect authentication data (set_id=scm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:25:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19108: 535 Incorrect authentication data (set_id=acruz@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:25:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48814: 535 Incorrect authentication data (set_id=melbourne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:24:57 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:24:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63090: 535 Incorrect authentication data (set_id=montgomery@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:25:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:25:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59720: 535 Incorrect authentication data (set_id=sochi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:25:12 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:25:24 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24862: 535 Incorrect authentication data (set_id=puzzle@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:26:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28134: 535 Incorrect authentication data (set_id=arum@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:26:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59912: 535 Incorrect authentication data (set_id=fresh@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:26:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4480: 535 Incorrect authentication data (set_id=confirm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:26:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59810: 535 Incorrect authentication data (set_id=endpoint@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:26:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:26:03 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:26:14 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:25:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:26:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:27:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32090: 535 Incorrect authentication data (set_id=jeffrey@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:27:08 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:27:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65380: 535 Incorrect authentication data (set_id=fanclub@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:27:03 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:27:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36120: 535 Incorrect authentication data (set_id=user7@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:27:09 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:27:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48742: 535 Incorrect authentication data (set_id=testx@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:28:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:28:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46398: 535 Incorrect authentication data (set_id=solsol@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:28:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52970: 535 Incorrect authentication data (set_id=alvan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:28:09 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:28:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:27:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25076: 535 Incorrect authentication data (set_id=calendari@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:28:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:28:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32280: 535 Incorrect authentication data (set_id=cn@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.108.28.126
country_id: 690791
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-baguida-1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49220: 535 Incorrect authentication data (set_id=seller@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:29:11 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:29:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57998: 535 Incorrect authentication data (set_id=smiley's@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:29:39 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:28:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5796: 535 Incorrect authentication data (set_id=ozdemir@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:29:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29154: 535 Incorrect authentication data (set_id=pta@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:29:25 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.94
country_id: 226074
description:
Jun 29 23:29:51 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:28:57 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:30:04 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:30:09 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:30:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5404: 535 Incorrect authentication data (set_id=space@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:30:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48672: 535 Incorrect authentication data (set_id=cse@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:30:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38722: 535 Incorrect authentication data (set_id=jgarcia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:30:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34098: 535 Incorrect authentication data (set_id=enomoto@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.94
country_id: 226074
description:
Jun 29 23:29:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:30:13 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:29:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:30:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:5438: 535 Incorrect authentication data (set_id=cse@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:31:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42088: 535 Incorrect authentication data (set_id=coast@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:31:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:31:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59422: 535 Incorrect authentication data (set_id=cable@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.19.194
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.19.194: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:31:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46084: 535 Incorrect authentication data (set_id=half@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:31:06 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:30:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:31:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47142: 535 Incorrect authentication data (set_id=crystal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:31:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:31:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55640: 535 Incorrect authentication data (set_id=ism@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:32:08 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:32:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40348: 535 Incorrect authentication data (set_id=nbs@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:32:28 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:32:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62976: 535 Incorrect authentication data (set_id=smtps@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.19.194
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.19.194: 211 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:32:17 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:32:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62962: 535 Incorrect authentication data (set_id=public1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:32:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:33:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:8720: 535 Incorrect authentication data (set_id=buzon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:33:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:33:08 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:33:12 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:33:13 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:33:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39158: 535 Incorrect authentication data (set_id=flip@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:33:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2832: 535 Incorrect authentication data (set_id=isletme@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:33:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48396: 535 Incorrect authentication data (set_id=flip@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:33:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39284: 535 Incorrect authentication data (set_id=produccion@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:34:03 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:34:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15568: 535 Incorrect authentication data (set_id=aulavirtual@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:34:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:34:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11528: 535 Incorrect authentication data (set_id=brasil@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:34:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49582: 535 Incorrect authentication data (set_id=ari@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:34:09 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:34:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43402: 535 Incorrect authentication data (set_id=mail8@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:33:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.189.194
country_id: 3469034
description:
Jun 29 23:35:32 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.189.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-29 23:35:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19386: 535 Incorrect authentication data (set_id=astrachan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 29 23:35:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-29 23:35:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32770: 535 Incorrect authentication data (set_id=memory@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:35:05 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 29 23:35:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:35:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5862: 535 Incorrect authentication data (set_id=pass@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.220.176.80
country_id: 6290252
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-en-fete-baguida-1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 29 23:34:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-29 23:35:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52456: 535 Incorrect authentication data (set_id=suministros@ns5.netmaster.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.12.100.166
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 29 23:36:07 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-29 23:36:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51446: 535 Incorrect authentication data (set_id=wan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 29 23:37:46 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-29 23:38:15 +0000] info [cpaneld] 64.111.92.123 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 146.70.65.191
country_id: 2328926
domain: www.ccl.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.100.242
country_id: 2921044
description:
185.220.100.242 - gsizyncj [29/Jun/2026:23:46:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129955&pdata=https%253A%252F%252Fortouche.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782776792 HTTP/2.0" 302 0 ortouche.com "https://ortouche.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.100.242


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.50
country_id: 1814991
description:
123.6.49.50 - - [29/Jun/2026:23:46:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051974&pdata=https%253A%252F%252Fwages.tg%252Frecrutement-stage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782776808 HTTP/2.0" 302 0 wages.tg "https://wages.tg/recrutement-stage/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.50


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.241.169
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.245.241.169||TA:104.245.241.169||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.144.42.64
country_id: 6252001
description:
2026-06-29 23:51:03 dovecot_plain authenticator failed for H=(ctc33b3fgexu7bo44sb8ckakuyge) [136.144.42.64]:59071: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 00:00:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 00:00:20 +0000] info [cpaneld] 64.111.92.123 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 23.106.44.110
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/images/images/cache.php||SC:/home/ygpdcalt/public_html/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 00:07:04 +0000] info [cpaneld] 129.212.228.74 - pduusmyf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.174.58.246
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 68.101.127.142
country_id: 6252001
description:
68.101.127.142 - - [30/Jun/2026:00:09:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027991&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F03%252F1win-uzbekistan-rasmiy-sayti-bukmekerlik-kompaniyasining-al-afrah-plastic-type-product-trading-safety-precautions-screens-and-cup-for-doors-along-with-windows%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782778140 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/03/1win-uzbekistan-rasmiy-sayti-bukmekerlik-kompaniyasining-al-afrah-plastic-type-product-trading-safety-precautions-screens-and-cup-for-doors-along-with-windows/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:68.101.127.142


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.14.78
country_id: 6252001
description:
[2026-06-30 00:10:31 +0000] info [cpaneld] 195.63.14.78 - mpqypjjp "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.23
country_id: 1880251
description:
43.173.179.23 - - [30/Jun/2026:00:11:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932630&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F22510&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782778272 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/22510" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.186.243.241
country_id: 1562822
description:
[2026-06-30 00:12:04 +0000] info [cpaneld] 113.186.243.241 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.165
country_id: 690791
description:
Jun 30 00:14:55 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.165
country_id: 690791
description:
Jun 30 00:15:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.186.243.241
country_id: 1562822
description:
[2026-06-30 00:15:49 +0000] info [cpaneld] 113.186.243.241 - joseph@admin.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e803808cdd2673e10163f4adc02b360aae9e7de||Title:ebvntjku4mudmrte||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a9bd2814643c95c741f45d62cfbb2e67514767b||Title:6wospvwnbkqhj6w5x||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f148c56a329e982f276577a8805e6cc1df1c9c4f||Title:z6vmhmbh6hddtjvs||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.122
country_id: 3469034
description:
Jun 30 00:22:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1959feebe1155b3b3827f1521579f716ebcf6ae||Title:bm30jgxe3yer15ebe||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:37d4e3741affd58bcd3ffdb9de482ebdc45f4c5c||Title:icjpuicq3wbpiy||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.122
country_id: 3469034
description:
Jun 30 00:23:06 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 00:23:25 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.45.163.63
country_id: 3469034
description:
[2026-06-30 00:24:35 +0000] info [cpaneld] 189.45.163.63 - kwbcfbmo "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49c159d6e0c7655853ec1f273f2708e9699d5c17||Title:kq3w2chans3cd2wch||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.191
country_id: 1880251
description:
47.128.121.191 - - [30/Jun/2026:00:24:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247460&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ftorture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782779080 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/torture/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.191


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.237
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-24.168.196.238.237||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.108.13
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-24.190.185.108.13||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e02a1dd8ce0910b06fcbf71970232c14a7a384b8||Title:tafy7q92uqo1yx6c||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.136.168.37
country_id: 3996063
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/ayizan-2023-apotheose HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 00:25:58 +0000] info [cpaneld] 167.99.236.81 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.24.210
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 74.63.24.210: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2a8f3efbea3c9a3d286fa3c56eb0663facdccf8||Title:4u7v3am5js9hml||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.203.189.154
country_id: 6252001
description:
[2026-06-30 00:26:46 +0000] info [cpaneld] 159.203.189.154 - antasadmin "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.89.7.198
country_id: 2921044
description:
[2026-06-30 00:26:48 +0000] info [cpaneld] 159.89.7.198 - antasadmin "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a4a44f61b1e3095e7183c0090dd1115141753f97||Title:v76jl2lkf30nm6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e239ce51e0fcf31e895ae91ba141d7846ae78194||Title:2nnh9vej7qok8e1g||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f007670ea55b5ccd82253aec3d28283c4ee95117||Title:1r2tlc8f45dkr9||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3fe29dc7fa292a55384a4b0c14def3669f7d1dd||Title:g8f7pre5hnq7omftf||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.233.16.72
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/24.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f5ebbed302f28ef2db1775eb062cce72cd11818||Title:bjklqwdlz1qz6frh9z||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80b8d4a1d80bbd80543bdc5279aea63a314a41b7||Title:b9msy2juj5i1fbr3ng||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.82.223.207
country_id: 1269750
description:
45.82.223.207 - - [30/Jun/2026:00:33:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315415&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fmartin-fayulu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782779584 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/martin-fayulu/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.4108.1224 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.82.223.207


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a892cce1e0793b18a7248b48cda62352c652fd40||Title:ddk4uw774as2gs||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:495746f32a51448e9b1eacad8fad21dd0233c2d0||Title:i1hbxsu3xiaa9q6n2h||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:254d186b8133523e794b73f33c7eb5af93f3aa40||Title:6gcsup7xfonraht||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.220.44.129
country_id: 1269750
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:support!.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:799a12c38a1439fd65d641bd25c3e551eaf92545||Title:evjt65xpvx8t3z0f||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.76.50.75
country_id: 1562822
description:
2026-06-30 00:37:23 dovecot_plain authenticator failed for H=(localhost) [115.76.50.75]:24922: 535 Incorrect authentication data (set_id=contacts@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.76.50.75
country_id: 1562822
description:
Jun 30 00:37:21 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.76.50.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.213.38
country_id: 6252001
description:
2026-06-30 00:37:28 dovecot_plain authenticator failed for H=(awkre7wkdyf9r7prant0ohoc3rpc) [104.28.213.38]:23930: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.88
country_id: 1880251
description:
43.173.179.88 - - [30/Jun/2026:00:37:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985626&pdata=http%253A%252F%252Fsoena.tg%252Fproduct-category%252Fwatches%252F%253Fadd_to_wishlist%253D9588%2526_wpnonce%253D7317b071a0&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782779861 HTTP/1.1" 404 561 soena.tg "http://soena.tg/product-category/watches/?add_to_wishlist=9588&_wpnonce=7317b071a0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 00:38:14 +0000] info [cpaneld] 129.212.228.74 - antasadmin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.52.122.121
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/08/risques-d-inondations-dans-la-region-des-savanes_i1200.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.78.217
country_id: 1694008
description:
[2026-06-30 00:42:04 +0000] info [cpaneld] 136.158.78.217 - pduusmyf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 00:42:53 +0000] info [cpaneld] 64.111.92.123 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2026-06-30 00:43:04 dovecot_login authenticator failed for H=([184.185.2.254]) [175.100.107.238]:43416: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.228.22
country_id: 1269750
description:
Jun 30 00:43:41 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.228.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Jun 30 00:43:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-06-30 00:43:43 dovecot_login authenticator failed for H=([187.6.121.246]) [182.95.228.22]:56782: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-30 00:43:43 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-30 00:43:44 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess9647948313/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.183.51.144
country_id: 1269750
description:
2026-06-30 00:45:49 dovecot_plain authenticator failed for H=(localhost) [122.183.51.144]:23363: 535 Incorrect authentication data (set_id=andre.k@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 00:46:08 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 155.254.42.26
country_id: 2750405
description:
155.254.42.26 - - [30/Jun/2026:00:47:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038313&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D477&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782780431 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=477" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.7486.1621 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:155.254.42.26


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.178.197.125
country_id: 6252001
description:
2026-06-30 00:49:52 dovecot_login authenticator failed for H=(ewqrm.com) [209.178.197.125]:58212: 535 Incorrect authentication data (set_id=andre.k@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.159.254.104
country_id: 192950
description:
154.159.254.104 - - [30/Jun/2026:00:50:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13356139&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-307306aitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782780625 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-307306aitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:154.159.254.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 00:53:35 +0000] info [cpaneld] 167.99.236.81 - wgqhqbem "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.207.114
country_id: 1643084
description:
[2026-06-30 01:02:03 +0000] info [whostmgrd] 202.51.207.114 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [30/Jun/2026:01:04:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920808&pdata=http%253A%252F%252Fkoko.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782781448 HTTP/1.1" 302 0 koko.kpmg.tg "http://koko.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.217.41.67
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.217.41.67: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [30/Jun/2026:01:06:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317211&pdata=http%253A%252F%252Fwww.pub.soena.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782781580 HTTP/1.1" 302 0 www.pub.soena.tg "http://www.pub.soena.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.217.41.104
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.217.41.104: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.217.41.118
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.217.41.118: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.217.41.120
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.217.41.120: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.139.136.136
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.139.136.136: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.217.41.90
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.217.41.90: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 01:13:11 +0000] info [cpaneld] 64.111.92.123 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.187.83.212
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/mifa1.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 01:17:50 +0000] info [cpaneld] 167.99.236.81 - afxvhoxo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.194.179
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/pizzavi/pizza-pizzavi/pizzavi/?add-to-cart=2009||QS:add-to-cart=2009||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.140.78.114
country_id: 1643084
description:
[2026-06-30 01:18:28 +0000] info [cpaneld] 103.140.78.114 - AWADI "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.233.229
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.180.233.229||TA:194.180.233.229||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [30/Jun/2026:01:19:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120852&pdata=http%253A%252F%252Fhenkagroupe.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782782346 HTTP/1.1" 302 0 henkagroupe.com "http://henkagroupe.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.164
country_id: 1880251
description:
43.173.174.164 - - [30/Jun/2026:01:26:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12831853&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fafricains%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782782789 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/africains/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.247.242
country_id: 1814991
description:
Jun 30 01:26:39 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.145.247.242
country_id: 1814991
description:
2026-06-30 01:26:41 dovecot_login authenticator failed for H=([71.12.241.225]) [118.145.247.242]:52648: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.140.78.114
country_id: 1643084
description:
[2026-06-30 01:28:36 +0000] info [cpaneld] 103.140.78.114 - esso "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.140.78.114
country_id: 1643084
description:
[2026-06-30 01:29:46 +0000] info [cpaneld] 103.140.78.114 - czqxxxnu "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.140.78.114
country_id: 1643084
description:
[2026-06-30 01:31:24 +0000] info [cpaneld] 103.140.78.114 - czqxxxnu "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 01:31:43 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 01:32:35 +0000] info [cpaneld] 64.111.92.123 - 2083ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.25
country_id: 1269750
description:
Jun 30 01:37:04 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.208
country_id: 3469034
description:
Jun 30 01:38:40 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.140.78.114
country_id: 1643084
description:
[2026-06-30 01:38:08 +0000] info [cpaneld] 103.140.78.114 - admin "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.137.21
country_id: 1814991
description:
2026-06-30 01:39:13 dovecot_login authenticator failed for H=(duaLaDi) [39.152.137.21]:37690: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 01:40:11 +0000] info [cpaneld] 64.111.92.123 - concours "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 01:43:59 +0000] info [cpaneld] 64.111.92.123 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 01:46:00 +0000] info [cpaneld] 129.212.228.74 - wifizoneuser "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.121
country_id: 1880251
description:
47.128.121.121 - - [30/Jun/2026:01:49:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804190&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fpluie-25-mai-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782784149 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/pluie-25-mai-2025/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.121


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.228
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.228: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 27.115.124.101
country_id: 1814991
description:
27.115.124.101 - - [30/Jun/2026:01:51:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262627&pdata=http%253A%252F%252Fmesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782784286 HTTP/1.1" 404 561 mesyscom.com "http://mesyscom.com/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 01:52:17 +0000] info [cpaneld] 64.111.92.123 - concours "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.191
country_id: 3175395
description:
Jun 30 01:53:39 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.219
country_id: 3469034
description:
Jun 30 01:54:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 01:54:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 173.239.236.1
country_id: 1733045
description:
Jun 30 01:55:17 ns5 pure-ftpd[1443703]: (?@173.239.236.1) [WARNING] Authentication failed for user [butodra]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [30/Jun/2026:01:57:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936794&pdata=http%253A%252F%252Fhenkagroupe.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782784643 HTTP/1.1" 302 0 henkagroupe.com "http://henkagroupe.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 01:57:34 +0000] info [cpaneld] 64.111.92.123 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 157.148.43.217
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:systeme-de-sante-au-togo-les-ressources-mobilisees-de-2017-a-2021/||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.36.123.54
country_id: 174982
description:
46.36.123.54 - - [30/Jun/2026:02:07:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264421&pdata=https%253A%252F%252Fwebmail.inh.free.netmaster.tg%252F%253Flocale%253Dpl&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782785234 HTTP/2.0" 302 0 webmail.inh.free.netmaster.tg "https://webmail.inh.free.netmaster.tg/?locale=pl" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.36.123.54


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 156.176.255.82
country_id: 357994
description:
Denial of Service (DoS) attack was discovered from 156.176.255.82: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 02:17:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 126.118.196.110
country_id: 1861060
description:
[2026-06-30 02:18:28 +0000] info [cpaneld] 126.118.196.110 - cvajhehu "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:18:08 +0000] info [cpaneld] 64.111.92.123 - rsgwljmi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rsgwljmi (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.227
country_id: 1880251
description:
43.172.198.227 - - [30/Jun/2026:02:18:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449822&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Fle-president-centrafricain-touadera-attendu-a-lome%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782785935 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/diplomatie/le-president-centrafricain-touadera-attendu-a-lome/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:23:50 +0000] info [cpaneld] 64.111.92.123 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 02:23:32 +0000] info [cpaneld] 129.212.228.74 - su_docteur "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user su_docteur (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 187.45.125.230
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 187.45.125.230: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:29:33 +0000] info [cpaneld] 64.111.92.123 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.142.37.190
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.142.37.190||TA:193.142.37.190||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:31:25 +0000] info [cpaneld] 64.111.92.123 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:34:12 +0000] info [cpaneld] 64.111.92.123 - Benito "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Benito (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.55.170
country_id: 2921044
domain: mail.stephane.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.stephane.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.177.188
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/wingsn-shake/accompagnement/pommes-sautees/?add-to-cart=1883||QS:add-to-cart=1883||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:37:02 +0000] info [cpaneld] 64.111.92.123 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.109.218
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-37.190.185.109.218||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.43.94.105
country_id: 1210997
description:
2026-06-30 02:37:58 dovecot_plain authenticator failed for H=(localhost) [103.43.94.105]:63478: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 02:40:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.237.85.9
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.237.85.9: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:42:17 +0000] info [cpaneld] 64.111.92.123 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:43:13 +0000] info [cpaneld] 64.111.92.123 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.201.118.114
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.201.118.114: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:47:50 +0000] info [cpaneld] 64.111.92.123 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 02:48:29 +0000] info [cpaneld] 64.111.92.123 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.88.214.174
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.88.214.174: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 02:48:05 +0000] info [cpaneld] 167.99.236.81 - index.live.php "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user index.live.php (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:02:49:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264010&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782787791 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.211.225.172
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.211.225.172: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [30/Jun/2026:02:49:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657220&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782787797 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.211.225.172
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.211.225.172: 175 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:02:50:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130580&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782787833 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 02:52:19 +0000] info [cpaneld] 129.212.228.74 - iyfttuec "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.107
country_id: 3175395
description:
Jun 30 02:55:33 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.244
country_id: 3865483
description:
Jun 30 02:55:42 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.244
country_id: 3865483
description:
Jun 30 02:55:58 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.244 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.90.27.26
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.90.27.26: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 52.37.6.212
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 52.37.6.212: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.248.152.231
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.248.152.231: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.86.250.179
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.86.250.179: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 03:01:44 +0000] info [cpaneld] 64.111.92.123 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 03:03:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.142.73.116
country_id: 2017370
domain: cafe.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-03.91.142.73.116||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [30/Jun/2026:03:04:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000490&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782788672 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.148.10.201
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 45.148.10.201: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.121
country_id: 1880251
description:
47.128.121.121 - - [30/Jun/2026:03:05:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13159269&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Felu-president-elu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782788756 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/elu-president-elu/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.121
country_id: 1880251
description:
47.128.121.121 - - [30/Jun/2026:03:08:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7366761&pdata=https%253A%252F%252Ftogomedia24.tg%252Fauthor%252Faubin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782788894 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/author/aubin/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.121


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-30 03:11:07 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-30 03:11:08 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess0211552110/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.89
country_id: 798544
description:
Jun 30 03:15:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.78.145.237
country_id: 2635167
description:
[2026-06-30 03:15:37 +0000] info [cpaneld] 81.78.145.237 - iyfttuec "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.154.98.82
country_id: 2750405
description:
[2026-06-30 03:15:45 +0000] info [whostmgrd] 45.154.98.82 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.154.98.82
country_id: 2750405
description:
[2026-06-30 03:15:45 +0000] info [whostmgrd] 45.154.98.82 - root "GET /cpsess8270968064/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.141
country_id: 3175395
description:
209.227.239.141 - - [30/Jun/2026:03:18:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289364&pdata=https%253A%252F%252Fconfortis.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782789528 HTTP/2.0" 302 0 confortis.tg "https://confortis.tg/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.163.38.103
country_id: 3077311
description:
Jun 30 03:19:15 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.163.38.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.157.197
country_id: 1819730
description:
2026-06-30 03:19:34 dovecot_plain authenticator failed for H=(localhost) [104.28.157.197]:41516: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.154
country_id: 3865483
description:
Jun 30 03:20:51 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.154
country_id: 3865483
description:
Jun 30 03:20:59 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.96
country_id: 3469034
description:
Jun 30 03:21:39 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 03:25:53 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 03:25:34 +0000] info [cpaneld] 64.111.92.123 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.183.59.33
country_id: 130758
description:
Jun 30 03:27:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.183.59.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.183.59.33
country_id: 130758
description:
2026-06-30 03:27:12 dovecot_login authenticator failed for H=([89.218.247.234]) [94.183.59.33]:47720: 535 Incorrect authentication data (set_id=sales@sigm.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.243
country_id: 2635167
description:
[2026-06-30 03:27:46 +0000] info [cpaneld] 195.63.25.243 - qfaclpeg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.251.121.103
country_id: 241170
description:
2026-06-30 03:28:51 H=([196.251.121.103]) [196.251.121.103]:60941 F=<michalinasawicka@exedraevents.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 03:28:00 +0000] info [cpaneld] 64.111.92.123 - sky "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sky (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 03:31:37 +0000] info [cpaneld] 64.111.92.123 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.0.156.63
country_id: 3573591
domain: ilmu.ssl.sabah.gov.my:8080
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ilmu.ssl.sabah.gov.my:8080/webopac/Record/0000404458/Preview HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.0.156.63
country_id: 3573591
domain: www.swtor-raid.the-guardian-angels.de
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.swtor-raid.the-guardian-angels.de/viewcharacter.php?member_id=21&msort=6|desc&rsort=1|asc&s=41b7bf9b22ea6df010312f8df0c2e414eede10c1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.140.101.227
country_id: 3469034
description:
[2026-06-30 03:31:44 +0000] info [cpaneld] 192.140.101.227 - anadebfreenetmas "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-06-30 03:30:58 +0000] info [cpaneld] 66.116.242.211 - cloudetr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.118.47.81
country_id: 3573591
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/jidf-2026-le-ministere-du-commerce-met-lesthetique-au-coeur-du-debat/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.182.156
country_id: 3996063
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-amadahome-stout-porter HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.109.232.27
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Climat-des-affaires-le-Togo-renforce-son-attractivite-a-travers-un-dialogue-inedit-avec-les-investisseurs-europeens-300x200.webp HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-30 03:36:04 +0000] info [cpaneld] 51.83.5.75 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.208.42.55
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/347580328 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.182
country_id: 3175395
description:
Jun 30 03:38:32 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.31.187.144
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/1164631279 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.16.255.95
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/80143393 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.150.74.56
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/9fa5a2 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.120.138.210
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/767c87 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 03:44:41 +0000] info [cpaneld] 129.212.228.74 - lxsenjdd_farms "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.151.240.11
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/06/Aeroport-de-Lome.webp 441w, http:/togodailynews.tg/wp-content/uploads/2025/06/Aeroport-de-Lome-300x195.webp 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.207.149
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.163.207.149||TA:193.163.207.149||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 03:48:40 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.121
country_id: 3469034
description:
Jun 30 03:50:41 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.121 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.38.125.40
country_id: 1269750
description:
209.38.125.40 - - [30/Jun/2026:03:50:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579814&pdata=http%253A%252F%252Fappflutter.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782791407 HTTP/1.1" 302 0 appflutter.free.netmaster.tg "http://appflutter.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.38.125.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 145.241.169.123
country_id: 3017382
description:
[2026-06-30 03:51:26 +0000] info [cpaneld] 145.241.169.123 - waywcbyw "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.206
country_id: 51537
description:
Jun 30 03:51:02 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.63.188.216
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/697890 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.165.222
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/8 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 30 03:53:38 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [30/Jun/2026:03:56:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7168972&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782791801 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.153
country_id: 3469034
description:
Jun 30 03:59:16 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.42.237.142
country_id: 1269750
description:
2026-06-30 04:01:22 dovecot_plain authenticator failed for H=(localhost) [49.42.237.142]:50840: 535 Incorrect authentication data (set_id=minoussa@cameg-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.196.103.33
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/8d6440 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:04:02:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7261339&pdata=https%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782792121 HTTP/2.0" 302 0 confortis.tg "https://confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.129.139.145
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/916e5b HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.32.152.217
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1589959581 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 04:07:02 +0000] info [cpaneld] 64.111.92.123 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 04:07:42 +0000] info [cpaneld] 167.99.236.81 - a.kesso "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 04:07:58 +0000] info [cpaneld] 157.66.56.39 -  esso  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [30/Jun/2026:04:09:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053525&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782792543 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.229
country_id: 2077456
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:202.155.186.229||TA:202.155.186.229||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 04:10:15 +0000] info [cpaneld] 64.111.92.123 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.239.32.146
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/0207b95424681492afadb7a731556050_L.jpg 500w, /wp-content/uploads/2024/11/0207b95424681492afadb7a731556050_L-300x187.jpg 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.165
country_id: 2993457
description:
Jun 30 04:10:03 ns5 pure-ftpd[1506338]: (?@194.165.16.165) [INFO] New connection from 194.165.16.165


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.20.188.8
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/460702715 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 30 04:15:12 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.228
country_id: 1880251
description:
43.172.198.228 - - [30/Jun/2026:04:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727946&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Ffabre-nous-maintenons-le-cap-de-la-mobilisation-populaire-pour-poursuivre-la-resistance-en-dehors-de-la-c14%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782792942 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Ffabre-nous-maintenons-le-cap-de-la-mobilisation-populaire-pour-poursuivre-la-resistance-en-dehors-de-la-c14%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.122
country_id: 3469034
description:
Jun 30 04:17:07 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.161.125
country_id: 2363686
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/47.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 04:17:41 +0000] info [cpaneld] 64.111.92.123 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.101.64.6
country_id: 2017370
description:
5.101.64.6 - - [30/Jun/2026:04:19:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328469&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F%252F1%252F010e019f04f32703-75641a2f-318c-4f90-bfd6-f0baf75ad507-000000%252FhFw3NCHyF4rxByWPa2eYluDJiPU%253D258&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782793165 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr//1/010e019f04f32703-75641a2f-318c-4f90-bfd6-f0baf75ad507-000000/hFw3NCHyF4rxByWPa2eYluDJiPU=258" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.101.64.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.225.100.73
country_id: 719819
description:
[2026-06-30 04:19:29 +0000] info [cpaneld] 84.225.100.73 - cafeitadm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.99.50.246
country_id: 1522867
description:
2026-06-30 04:19:37 H=([37.99.50.246]) [37.99.50.246]:51479 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.109.106
country_id: 3865483
description:
Jun 30 04:22:10 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.109.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.11.194
country_id: 6252001
description:
[2026-06-30 04:24:59 +0000] info [cpaneld] 195.63.11.194 - qledpnjw "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.106.74.142
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.106.74.142: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.2.38.5
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-28.50.2.38.5||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.202
country_id: 3469034
description:
Jun 30 04:28:45 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.108.177.52
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-28.91.108.177.52||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 04:28:40 +0000] info [cpaneld] 129.212.228.74 - ucaouut "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.134.11.229
country_id: 1210997
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03df5546494aa24ccc2ff0ea858ffc9538d61122||Title:1ies2qk8womzf3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.202
country_id: 3469034
description:
Jun 30 04:29:00 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 04:29:11 +0000] info [cpaneld] 64.111.92.123 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.77.244.139
country_id: 6252001
description:
Jun 30 04:29:29 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.77.244.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.77.244.139
country_id: 6252001
description:
2026-06-30 04:29:31 dovecot_login authenticator failed for H=(75.97.176.147.res-cmts.blm.ptd.net) [64.77.244.139]:36947: 535 Incorrect authentication data (set_id=office@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.221.11.212
country_id: 6252001
description:
34.221.11.212 - - [30/Jun/2026:04:31:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395754&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F3ab2e605cafab0f046b95d461a96be5c%252F66fe440de5c3e86a03793c42215f2f04%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782793890 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/3ab2e605cafab0f046b95d461a96be5c/66fe440de5c3e86a03793c42215f2f04/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.221.11.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 30 04:34:22 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.186.243.241
country_id: 1562822
description:
[2026-06-30 04:36:21 +0000] info [cpaneld] 113.186.243.241 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.221.11.212
country_id: 6252001
description:
34.221.11.212 - - [30/Jun/2026:04:35:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247474&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Fffb26351ca0884cdba0fbb3b179a3b22%252Fb796193adc2ddcab2642e046563b2b9a%252F920aaf7b2d7bcc4d3239dfc7cf027600%252Findex.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782794156 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/ffb26351ca0884cdba0fbb3b179a3b22/b796193adc2ddcab2642e046563b2b9a/920aaf7b2d7bcc4d3239dfc7cf027600/index.php" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.221.11.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.199.122.176
country_id: 6252001
description:
[2026-06-30 04:36:14 +0000] info [cpaneld] 198.199.122.176 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 30 04:36:48 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.221.11.212
country_id: 6252001
description:
34.221.11.212 - - [30/Jun/2026:04:37:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051668&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782794225 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.221.11.212


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.19.147.10
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.19.147.10: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.142.0.13
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.142.0.13: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.19.147.126
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.19.147.126: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.142.0.14
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.142.0.14: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.19.147.71
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.19.147.71: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.38
country_id: 3469034
description:
Jun 30 04:45:40 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.38 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.19.147.20
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.19.147.20: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.142.0.121
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.142.0.121: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 04:49:25 +0000] info [cpaneld] 167.99.236.81 - websitecpanel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.2.85.76
country_id: 1880251
description:
Jun 30 04:49:50 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.2.85.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.160.210.183
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210815-WA0003-1.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.136
country_id: 3175395
description:
Jun 30 04:54:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.69
country_id: 3175395
description:
Jun 30 04:54:19 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.207.15.61
country_id: 2017370
description:
Jun 30 04:55:11 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.207.15.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.131.213.152
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.207.15.61
country_id: 2017370
description:
2026-06-30 04:55:13 dovecot_plain authenticator failed for H=(69ncecx74vjiduoy4n828u4dt3j5jbc) [178.207.15.61]:52091: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.244.133
country_id: 1643084
description:
Jun 30 04:58:23 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.244.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 04:59:51 +0000] info [cpaneld] 64.111.92.123 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.252.30.2
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/53.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 05:05:04 +0000] info [cpaneld] 64.111.92.123 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.152.54.111
country_id: 1168579
description:
Jun 30 05:06:33 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.152.54.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.54.111
country_id: 1168579
description:
2026-06-30 05:06:35 dovecot_login authenticator failed for H=([91.146.24.164]) [119.152.54.111]:49884: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.239.196
country_id: 3469034
description:
Jun 30 05:09:04 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.239.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.134.8
country_id: 3469034
description:
Jun 30 05:09:26 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.134.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.21
country_id: 1880251
description:
43.173.180.21 - - [30/Jun/2026:05:10:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800742&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fauthor%253D2%2526paged%253D333&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782796232 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?author=2&paged=333" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.21


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.22
country_id: 1880251
description:
43.173.180.22 - - [30/Jun/2026:05:12:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128170&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D2687&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782796352 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=2687" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.22


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.21
country_id: 1880251
description:
43.173.181.21 - - [30/Jun/2026:05:14:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118435&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D5621&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782796484 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=5621" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.21


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.11
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product/amkov-cdc3-7inch-tft-screen-18-cmos/?add-to-cart=584||QS:add-to-cart=584||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.32
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.32: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.161.211.209
country_id: 6254930
description:
188.161.211.209 - - [30/Jun/2026:05:22:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985114&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-343936witems%252Fetidm13in.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782796959 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-343936witems/etidm13in.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.161.211.209


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.226.249.174
country_id: 3895114
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/societe HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 05:24:27 +0000] info [cpaneld] 129.212.228.74 - bighostingsnbd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 05:24:47 +0000] info [cpaneld] 64.111.92.123 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 05:25:58 +0000] info [cpaneld] 167.99.236.81 - web_tv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 05:25:58 +0000] info [cpaneld] 167.99.236.81 - web "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.16.7
country_id: 337996
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/reunion-trimestrielle-societe-nouvelle-de-boissons-et-task-forces HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.206.148.214
country_id: 6251999
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2018/03/DECISION-N\xc2\xb0-045-ARSE-CDD-2016_Scan.pdf HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.39
country_id: 1643084
description:
[2026-06-30 05:29:27 +0000] info [cpaneld] 157.66.56.39 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.135.101.247
country_id: 1819730
description:
43.135.101.247 - - [30/Jun/2026:05:29:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989018&pdata=https%253A%252F%252Fvitrinenews.tg%252F2025%252F07%252F23%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782797368 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2025/07/23/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.135.101.247


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 05:31:18 +0000] info [cpaneld] 64.111.92.123 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 05:32:31 +0000] info [cpaneld] 64.111.92.123 - 2083web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 05:34:59 +0000] info [cpaneld] 64.111.92.123 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.232
country_id: 3865483
description:
Jun 30 05:38:35 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.232 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.177
country_id: 1880251
description:
47.128.121.177 - - [30/Jun/2026:05:39:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458821&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fle-ministres-hausse-le-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782797995 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/le-ministres-hausse-le-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.177
country_id: 1880251
description:
47.128.121.177 - - [30/Jun/2026:05:41:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002901&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fcedeao-sommet%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782798066 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/cedeao-sommet/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 05:41:30 +0000] info [cpaneld] 64.111.92.123 - admin@admin.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.136.106.123
country_id: 1210997
description:
2026-06-30 05:42:50 dovecot_plain authenticator failed for H=(9nmzppwz2dx23n5sf9juav75j0n) [103.136.106.123]:56138: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 05:46:02 +0000] info [cpaneld] 167.99.236.81 - admin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [30/Jun/2026:05:52:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869259&pdata=http%253A%252F%252Fns5mail.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782798752 HTTP/1.1" 302 0 ns5mail.netmaster.tg "http://ns5mail.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.7.120.61
country_id: 1210997
description:
[2026-06-30 05:54:10 +0000] info [cpaneld] 103.7.120.61 - AMEDEKA "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 05:55:08 +0000] info [cpaneld] 64.111.92.123 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.195
country_id: 1880251
description:
43.173.177.195 - - [30/Jun/2026:05:55:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725216&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D22871&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782798932 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=22871" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.195


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.89.134
country_id: 6252001
description:
47.251.89.134 - - [30/Jun/2026:05:57:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078662&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782799050 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.89.134


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.107
country_id: 298795
description:
Jun 30 05:59:54 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53279.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9790a8202fa7009bf5b20b2a4864dba02565537||Title:0xc96b0465||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.127.8.234
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-00.209.127.8.234||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.107
country_id: 298795
description:
Jun 30 06:00:01 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 06:00:43 +0000] info [cpaneld] 64.111.92.123 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c65955d062ff6fa07a702017f9e2ad23534792b6||Title:0x23397870||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4bca005fb39d615da5aaa3aa29a4d02a76761d61||Title:0x30ff874c||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea9e5e0cbdc783f2157afcd8316ec579275b3bbc||Title:0x5b9812d2||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e3d4693c4c4ea56bf7dfca44b7f732c7c03f152a||Title:0xce7b6831||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:34db6d6bd502a6ba1b4e670839a179a1b698697a||Title:0x861296f0||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.39.107.187
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 34.39.107.187: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.183.122
country_id: 1831722
description:
[2026-06-30 06:05:23 +0000] info [cpaneld] 103.164.183.122 NEW libertepansel:djYYm9HS4NkR9wAo address=103.164.183.122,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc604c4495c25c90971e96ba1d75d1fcbbafe72d||Title:0xcd1a1835||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 06:06:35 +0000] info [cpaneld] 129.212.228.74 - tresorerie "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:13db084ed8b35c2123d588b29972edbf74bded00||Title:0x29d23e91||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.234.140
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.234.140||TA:45.147.234.140||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [30/Jun/2026:06:08:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066790&pdata=http%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782799697 HTTP/1.1" 302 0 matosshop.tg "http://matosshop.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d3fa29b7dea1bd06ed53a5f6a33e6aa20e894bac||Title:0x97baa343||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.161.105.5
country_id: 1210997
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/a-propos HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [30/Jun/2026:06:08:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918766&pdata=https%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782799718 HTTP/2.0" 302 0 matosshop.tg "https://matosshop.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df47716a7e6c0e384b41cc1202f6987fcd652042||Title:0x7e94ea52||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.50
country_id: 3175395
description:
Jun 30 06:10:27 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:960b42910ec403336ef870eb4a28174f831d28e7||Title:0x28cb0daf||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:16d3a520f160b10ca99b1309eea3a70552b45554||Title:0x49ea9b15||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b37bbb2cddea5fa9edf955577c7d50511258c8c8||Title:0x2f166738||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.146.4.39
country_id: 6252001
description:
16.146.4.39 - - [30/Jun/2026:06:13:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327651&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252F5a62aa212b86bc08a2d77c395174ea68%252F53e05f3a2e9baf658df1f5afabd4036d%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782799984 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/5a62aa212b86bc08a2d77c395174ea68/53e05f3a2e9baf658df1f5afabd4036d/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.146.4.39


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b46daeb53d09740ac81c6a376b2943ac37cb774a||Title:0x32a4dc46||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b07da3f4c045c453fd07361f7093b7283a38146||Title:0x81cba8f0||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40c83dc8ef9904b16d07564fdd20bf6378f1f4c1||Title:0x6eb4dc54||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.248
country_id: 2635167
description:
[2026-06-30 06:16:41 +0000] info [cpaneld] 195.63.26.248 - sxoyfjqv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.117.53
country_id: 1269750
domain: soeurndetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:esagmasterweb.soeurndetogo.com||ServerName:soeurndetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d97b79349765c67301d4b14b66eefbbd89ad79ab||Title:0x84dab075||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.129.108
country_id: 1168579
domain: confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/confortis.tg/NosPublications HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.144.94
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf7ce572f3bd45a68821654a1d963f99ced09ee2||Title:nsy3f75uf2pbvapuz||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.144.94
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b33df26aa4e2a07df349e517cec8ac585fd7a18||Title:kmmqhkqwxs9gj5t||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [30/Jun/2026:06:19:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934792&pdata=http%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782800374 HTTP/1.1" 302 0 matosshop.tg "http://matosshop.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.147.88
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42a537f4c46a113baf50291a36ac09e4995f9dff||Title:3tj6ne86bslxe3o||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.147.88
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa3b0802946f48cae5208a78781b48e059c9ffd4||Title:meb1rakkycedptl||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.147.88
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0344dfa09a31c750421925a55c91ffddee32055f||Title:w5div15hmjkecl||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.222.178
country_id: 1269750
description:
Jun 30 06:23:57 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.222.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 06:24:48 +0000] info [cpaneld] 129.212.228.74 - heroes "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-06-30 06:23:59 dovecot_plain authenticator failed for H=(anthests) [182.95.222.178]:34380: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.108
country_id: 1880251
description:
43.172.197.108 - - [30/Jun/2026:06:25:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461289&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252F2024%252F01%252F12%252Fla-brasserie-bb-lome-en-guerre-contre-les-accidents-de-circulation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782800715 HTTP/1.1" 404 561 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/2024/01/12/la-brasserie-bb-lome-en-guerre-contre-les-accidents-de-circulation/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.108


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.194.186
country_id: 1880251
description:
43.172.194.186 - - [30/Jun/2026:06:26:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196331&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D6747&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782800787 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=6747" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.194.186


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-30 06:30:26 +0000] info [cpaneld] 51.83.4.64 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 06:31:03 +0000] info [cpaneld] 64.111.92.123 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.58.41.156
country_id: 2921044
description:
89.58.41.156 - utkxprkk [30/Jun/2026:06:32:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791849&pdata=https%253A%252F%252Fletempsdaider.org%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782801160 HTTP/2.0" 302 0 letempsdaider.org "https://letempsdaider.org:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.58.41.156


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.22
country_id: 1880251
description:
43.172.196.22 - - [30/Jun/2026:06:32:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197402&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D11969&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782801162 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=11969" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.22


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.146.4.39
country_id: 6252001
description:
16.146.4.39 - - [30/Jun/2026:06:34:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778724&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252F714c81ee2d0a7acc45a6c14cc2395b67%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782801266 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/714c81ee2d0a7acc45a6c14cc2395b67/index.php?cmd=login/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.146.4.39


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.39
country_id: 1643084
description:
[2026-06-30 06:34:34 +0000] info [cpaneld] 157.66.56.39 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.167
country_id: 1880251
description:
43.173.180.167 - - [30/Jun/2026:06:37:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251715&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14261&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782801464 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14261" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.167


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-30 06:37:14 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess3881237129/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-30 06:37:13 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.224.78.81
country_id: 2661886
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-pilsner-donne-la-joie-aux-amoureux-du-ballon-rond HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.88.163.110
country_id: 6252001
description:
35.88.163.110 - - [30/Jun/2026:06:38:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301779&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782801507 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/index.php?cmd=newupld" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.88.163.110


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 06:41:38 ns5 pure-ftpd[1595036]: (?@134.122.27.233) [WARNING] Authentication failed for user [oscarandresbeatrice@gmail.com]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 06:41:14 +0000] info [cpaneld] 64.111.92.123 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 06:41:34 ns5 pure-ftpd[1595036]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.137
country_id: 1880251
description:
43.173.179.137 - - [30/Jun/2026:06:41:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063400&pdata=https%253A%252F%252Ftdn.tg%252Foif-recrute-enseignants-francais&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782801713 HTTP/1.1" 404 561 tdn.tg "https://tdn.tg/oif-recrute-enseignants-francais" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 06:43:24 +0000] info [cpaneld] 64.111.92.123 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.20.212.250
country_id: 241170
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:178.20.212.250||TA:178.20.212.250||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 06:43:41 +0000] info [cpaneld] 20.212.169.175 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.92.124.193
country_id: 2017370
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-44.45.92.124.193||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.88.163.110
country_id: 6252001
description:
35.88.163.110 - - [30/Jun/2026:06:45:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844059&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e%252F35f1f35508db0f1f5637ad1622c8b6dd%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782801933 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e/35f1f35508db0f1f5637ad1622c8b6dd/index.php?cmd=newupld/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.200 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.88.163.110


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 178.250.190.6
country_id: 2017370
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-45.178.250.190.6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.208.131.44
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/chefferie-traditionnelle-le-gouvernement-enterine-la-designation-de-15-chefs-de-canton/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-30 06:46:59 +0000] info [cpaneld] 51.83.5.75 - mpqypjjp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 06:47:21 +0000] info [cpaneld] 64.111.92.123 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.124
country_id: 1880251
description:
47.128.121.124 - - [30/Jun/2026:06:50:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9596007&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fsanvee-ohini-kwao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782802250 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/sanvee-ohini-kwao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 74.179.67.139
country_id: 6252001
description:
74.179.67.139 - - [30/Jun/2026:06:51:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339738&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782802308 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.179.67.139


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.169
country_id: 1880251
description:
43.173.181.169 - - [30/Jun/2026:06:53:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000998&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9427&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782802391 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=9427" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.169


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.86.168.171
country_id: 102358
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/media-press-requests/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 06:59:44 ns5 pure-ftpd[1601415]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 06:59:49 ns5 pure-ftpd[1601415]: (?@134.122.27.233) [WARNING] Authentication failed for user [Kisiniov.com]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.68.210.41
country_id: 2017370
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-59.109.68.210.41||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [30/Jun/2026:06:59:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039945&pdata=http%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782802750 HTTP/1.1" 302 0 afriquerevelation.tg "http://afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.234.147.122
country_id: 953987
domain: www.zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.zephyr.tg/zephyr.htm HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.196.57.195
country_id: 3469034
domain: www.zephyr.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.zephyr.tghttp/www.zephyr.tg/zephyr.htm HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.124
country_id: 1880251
description:
43.173.177.124 - - [30/Jun/2026:07:05:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144405&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D13712&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782803138 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=13712" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.124


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.160.92.68
country_id: 1168579
description:
Denial of Service (DoS) attack was discovered from 119.160.92.68: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 07:06:17 +0000] info [cpaneld] 64.111.92.123 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.30.66
country_id: 3017382
domain: www.site.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.site.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.91
country_id: 1880251
description:
43.173.180.91 - - [30/Jun/2026:07:15:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673109&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14506&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782803748 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14506" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.91


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.194.166
country_id: 1880251
description:
43.172.194.166 - - [30/Jun/2026:07:15:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405529&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D12868&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782803748 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=12868" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.194.166


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 07:15:02 +0000] info [cpaneld] 167.99.236.81 - a.mathey "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 07:17:01 +0000] info [cpaneld] 167.99.236.81 - contactmairieaneho "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.47
country_id: 1880251
description:
43.173.182.47 - - [30/Jun/2026:07:19:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016214&pdata=https%253A%252F%252Flepoint-actu.tg%252Findex.php%252F2024%252F04%252F27%252Fressortissants-de-tchitchaobou-a-lome-soutiennent-unir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782803950 HTTP/1.1" 404 561 lepoint-actu.tg "https://lepoint-actu.tg/index.php/2024/04/27/ressortissants-de-tchitchaobou-a-lome-soutiennent-unir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.47


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.2.156.154
country_id: 3608932
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/special-journee-de-de-don-de-sang HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.97.225.161
country_id: 1831722
description:
[2026-06-30 07:21:46 +0000] info [cpaneld] 58.97.225.161 - pduusmyf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any sort of inquiries relating to where and just how to utilize ||MV:gt;If you have any sort of inquiries relating to where and just how to utilize ||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [30/Jun/2026:07:23:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000534&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F28%252Fnouvelles-frappes-americaines-contre-liran-la-treve-de-nouveau-fragilisee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782804217 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/28/nouvelles-frappes-americaines-contre-liran-la-treve-de-nouveau-fragilisee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 07:24:34 +0000] info [webmaild] 160.242.195.10 - ppagah@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [30/Jun/2026:07:26:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066025&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F15%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782804360 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/15/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.25
country_id: 3469034
description:
Jun 30 07:26:42 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.25 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [30/Jun/2026:07:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939934&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F28%252Fcoupe-du-monde-2026-lafrique-confirme-sa-montee-en-puissance%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782804412 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/28/coupe-du-monde-2026-lafrique-confirme-sa-montee-en-puissance/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 07:27:02 +0000] info [cpaneld] 20.212.169.175 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2141e62a151e58c81f568fd99dfde9190da3b793||Title:pt2h4t1j3nwjumo0i||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (223.185.14.183) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 49.36.34.123
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (49.36.34.123) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8392cfc66cc066f418237c903f73efa4c26a8e95||Title:l91eq7umvtrv07zn||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.34.123
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:949e8533f51195ada9f4549f2a86972cd14f89fd||Title:x2g0bva4k6qjtkm4b||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [30/Jun/2026:07:30:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260057&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F28%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782804621 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/28/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.221.188
country_id: 2363686
description:
[2026-06-30 07:30:57 +0000] info [cpaneld] 102.64.221.188 NEW mgvybwur:9JDmlbXn2mkgP2YQ address=102.64.221.188,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.34.123
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc161254fb6c5ced0ca09e113a64c6b4c735ca6d||Title:wfhmjdtpztlexx3u91||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.210
country_id: 1269750
description:
Jun 30 07:30:31 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c01ab49fdf52742dcf111bf43a4742e6178816e2||Title:kb71p3dv0bt4ej||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c2b39bf3d7e9bfe4c80525397c6de4c1a665ae9||Title:4g2lgpo7sbuwks||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 66.185.123.245
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 66.185.123.245: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.34.123
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:160437cefd176687134913c5ae080cf55ec79a43||Title:dl7vmvsdv1c3vgtqj||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 07:31:59 +0000] info [cpaneld] 64.111.92.123 - amedekabenoit@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a34909ec91cf60f6d649daa4a4771ddc14bd8c80||Title:acmunto7eejipb||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e303e649cd077768ef375816840f4cca9af1919||Title:2hpy4gqql48q9sb||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.34.123
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:65a121603a4e480870ef9d1be82b53db20e8c069||Title:xzp1unhac6by5g||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 30 07:33:14 ns5 pure-ftpd[1615523]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8fefc1eb15c5eb056600cbf89326608725c220e2||Title:qvatl5v2bo8a0g||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [30/Jun/2026:07:34:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514024&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fkryptocibule-un-voleur-de-cryptomonnaies-multitache&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782804847 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/a-la-une/kryptocibule-un-voleur-de-cryptomonnaies-multitache" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.34.123
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc92e8a0ad53fa3a7906b49ac69ccd6bfd421e0c||Title:wl1lqt473agiuwiy||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.34.123
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:56ab672b3f831e8b2700dd000ae08f112ef20456||Title:zdb2okld9uzcefe||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.158.200.116
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/filiere-coton-lome-au-centre-des-echanges-de-laca/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.158.200.116
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/filiere-coton-lome-au-centre-des-echanges-de-laca/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7283817f7a17153f0c2ef3fdee2e6cd1738a661c||Title:tbhjvmfxsdjob1le1v||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:828c4cd2e7d49cd0d7786a84de615ba6fd3cd05b||Title:3ttg0ykflauw71f||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 07:37:32 +0000] info [cpaneld] 129.212.228.74 - primuscourtiertg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f75f6ac486bda3b0f6657fdd008e33d63c2a749e||Title:1sa0vs51n7dx2q9||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d91daf1065026c3b696b69d09f52b429db6dd028||Title:cx5k8cj21se06801a||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:729c8f1b6a8fb49fff7ee05001e89d18c5bb23eb||Title:jjgjm9529pl5du3e0||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:01759ecfee44c733fe57e543c2df52f8c5617374||Title:7xfjnu3jin081lm||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.83.145.228
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 51.83.145.228: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.175.124.113
country_id: 298795
description:
Denial of Service (DoS) attack was discovered from 212.175.124.113: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0ebed9a123f3af7c99b80caf6d08ae51137ad97||Title:b6lt1jx0b2tlrzin||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.23.33
country_id: 3625428
description:
[2026-06-30 07:41:53 +0000] info [cpaneld] 181.208.23.33 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.21.161
country_id: 2921044
description:
[2026-06-30 07:41:12 +0000] info [cpaneld] 195.63.21.161 - rdlizssu "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32119a4367c216c745e4e12a232d41751c4b0784||Title:yjqr1tzvb3aze0ckp9||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a84bc472375d750837a165b9abe7dcde48a1b28||Title:f6k9m5vn65ykdc||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 07:43:31 +0000] info [cpaneld] 64.111.92.123 - ANANI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ANANI (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.185.14.183
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78e92aa164fdecb420484a36b1418f5e129c05be||Title:soj1pp4db0lsz4av34||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 211.75.42.136
country_id: 1668284
domain: bawasongroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bawasongroup.com/assets/images/logo-12.png HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.64.119
country_id: 1819730
description:
2026-06-30 07:50:42 dovecot_plain authenticator failed for H=(4xebr5i3uqo3qia5xw1mhqb5i2fl1) [47.82.64.119]:56311: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 07:50:07 +0000] info [cpaneld] 64.111.92.123 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.254.33.219
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/Fin-du-premier-seminaire-gouvernemental-de-lannee.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2023/03/Fin-du-premier-seminaire-gouvernemental-de-lannee-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/03/Fin-du-premier-seminaire-gouvernemental-de-lannee-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/03/Fin-du-premier-seminaire-gouvernemental-de-lannee-272x182.jpg 272w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.20.212.206
country_id: 241170
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:178.20.212.206||TA:178.20.212.206||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.23.73
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.sunu-group.com HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.153.83.15
country_id: 1643084
description:
103.153.83.15 - - [30/Jun/2026:07:52:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922707&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-139819fetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782805960 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-139819fetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.153.83.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.184.153.243
country_id: 1269750
description:
2026-06-30 07:53:40 dovecot_plain authenticator failed for H=(localhost) [223.184.153.243]:24619: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.28.133
country_id: 1835841
description:
2026-06-30 07:54:09 dovecot_login authenticator failed for H=([49.124.148.194]) [112.184.28.133]:49034: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.49
country_id: 1880251
description:
43.173.180.49 - - [30/Jun/2026:07:55:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803370&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D7585&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782806151 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=7585" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.219.204.81
country_id: 6252001
description:
Jun 30 07:56:50 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.219.204.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 07:56:52 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.219.204.81
country_id: 6252001
description:
2026-06-30 07:56:52 dovecot_login authenticator failed for H=wsip-72-219-204-81.ok.ok.cox.net ([94.16.17.141]) [72.219.204.81]:40644: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 08:00:37 +0000] info [cpaneld] 129.212.228.74 - pharma "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.85
country_id: 1880251
description:
43.173.179.85 - - [30/Jun/2026:08:02:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104405&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D10414&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782806571 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=10414" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.85


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.20.212.241
country_id: 241170
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:178.20.212.241||TA:178.20.212.241||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:04:19 +0000] info [cpaneld] 64.111.92.123 - mpqypjjp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:05:53 +0000] info [cpaneld] 167.99.236.81 - test "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.199.192.250
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 18.199.192.250: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:09:48 +0000] info [cpaneld] 217.15.161.214 -  masfloy  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.75.129
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-cci-togo-et-celle-dosaka-signent-une-convention-de-cooperation-pour-stimuler-les-echanges-economiques-a-lexpo-universelle-dosaka/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.75.129
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-cci-togo-et-celle-dosaka-signent-une-convention-de-cooperation-pour-stimuler-les-echanges-economiques-a-lexpo-universelle-dosaka/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:09:53 +0000] info [cpaneld] 64.111.92.123 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:08:59 +0000] info [cpaneld] 167.99.236.81 - a.kesso "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:11:24 +0000] info [cpaneld] 167.99.236.81 - masfloy "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.176.152.18
country_id: 1605651
description:
Denial of Service (DoS) attack was discovered from 103.176.152.18: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.226.107.46
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/815494270 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:18:05 +0000] info [cpaneld] 167.99.236.81 - e.carine "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:17:57 +0000] info [webmaild] 196.171.122.34 -  e.senahounvo@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:19:57 +0000] info [webmaild] 196.171.122.34 -  e.senahounvo@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:19:58 +0000] info [webmaild] 196.171.122.34 -  e.senahounvo@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.227
country_id: 1880251
description:
43.172.197.227 - - [30/Jun/2026:08:20:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973798&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D4070&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782807624 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=4070" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.227


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/30/2026:08:21:15 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-30 08:21:00 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:bshaEN3c6ESJGoXg address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:22:55 +0000] info [webmaild] 196.171.122.34 -  e.senahounvo@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 64.227.95.145
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 64.227.95.145: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [30/Jun/2026:08:23:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 togofarm.tg "https://togofarm.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380180&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782807821" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 46.161.50.108
country_id: 2017370
description:
46.161.50.108 - - [30/Jun/2026:08:23:49 +0000] "GET /favicon.ico HTTP/1.1" 415 587 togofarm.tg "https://togofarm.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380180&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782807821" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.161.50.108


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.189
country_id: 1880251
description:
43.173.176.189 - - [30/Jun/2026:08:23:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053219&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12806&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782807808 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=12806" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.189


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [30/Jun/2026:08:23:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380180&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782807821 HTTP/2.0" 404 561 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:24:20 +0000] info [webmaild] 196.171.122.34 -  e.senahounvo@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-06-30 08:24:01 dovecot_login authenticator failed for H=([101.13.2.183]) [128.185.197.42]:51682: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.54.233
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:162.252.54.233||TA:162.252.54.233||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:25:03 +0000] info [webmaild] 196.171.122.34 -  e.senahounvo@davakconsulting.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.15.161.214
country_id: 1880251
description:
[2026-06-30 08:26:36 +0000] info [cpaneld] 217.15.161.214 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [30/Jun/2026:08:26:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186346&pdata=https%253A%252F%252Fucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782808010 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/" "Mozilla/5.0 (Linux; Android 12; M2004J19C Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.1.9.4-bugfix AppVersion/26.4.3 PIA/1.4.3 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: ucao-uut.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2004J19C Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.1.9.4-bugfix AppVersion/26.4.3 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.88.218
country_id: 1512440
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/ouverture-ce-mardi-a-lome-du-16e-forum-de-lagoa/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/30/2026:08:32:10 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


