# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.146.238.204
country_id: 1880251
description:
[2026-06-30 08:32:01 +0000] info [cpaneld] 62.146.238.204 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.183.23
country_id: 2921044
domain: mail.smarty.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.smarty.tg.154-70-82-246.cpanel.site/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 152.136.40.205
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/kara-le-collectif-des-acteurs-de-la-filiere-sesame-en-assemblee-generale/<script async src=||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.112.13.213
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/334770417 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 08:36:25 +0000] info [webmaild] 160.242.195.10 - gndong@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.21.132.214
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/internet-mobile-le-togo-leader-de-luemoa/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.21.132.214
country_id: 286963
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/internet-mobile-le-togo-leader-de-luemoa/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.110
country_id: 1880251
description:
43.173.174.110 - - [30/Jun/2026:08:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077286&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D3095&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782808664 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=3095" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.110


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:38:03 ns5 pure-ftpd[1644525]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:38:09 ns5 pure-ftpd[1644525]: (?@134.122.27.233) [WARNING] Authentication failed for user [rolle]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:089e855c0d677f497021b08bb4ff1e3ee8cd33ef||Title:d5knr22k1k2k6363d||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.160
country_id: 3469034
description:
Jun 30 08:38:46 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 68.183.245.101
country_id: 1269750
description:
68.183.245.101 - - [30/Jun/2026:08:39:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662869&pdata=http%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782808747 HTTP/1.1" 302 0 wages.tg "http://wages.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:68.183.245.101


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.36.180.204
country_id: 3277605
description:
92.36.180.204 - - [30/Jun/2026:08:39:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052445&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-366019fetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782808786 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-366019fetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.36.180.204


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b196ec23c3a76b27d729ee7dcb84c858a082f78c||Title:qyxrll2lrnwg8h8cgk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29885949079e0d136dc04b1b5ea0e6a5f9edfca3||Title:qr0itjwmg58rk8||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:40:44 +0000] info [cpaneld] 167.99.236.81 - einguval "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-30 08:41:10 +0000] info [cpaneld] 68.183.234.53 -  myxlsnta  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9c0b3eb5079414f44863c15f600c4771c2be9884||Title:i7rf091hhs3wt6oq||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcb7f03110fe32f3fce58279c9d13797e756f19e||Title:5cnp84bous38hcmlw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07146b575766768812ead9a315bac7cf3de94ab8||Title:aacjufzcq9t3dqox3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:43:03 +0000] info [cpaneld] 64.111.92.123 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ae2741d3db825e9056ec85a8f3265e8f00911d93||Title:ne74rohatrfq3a7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.142.204
country_id: 3658394
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/donnee HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@cloud-et-racks.tg [06/30/2026:08:45:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:45:38 +0000] info [cpaneld] 64.111.92.123 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0c2f579412de9643e624032326576f24a2b1d79||Title:mzy2snkc9l3uigb1qj||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4bef22ae527cb8343e3a73aa68d3c7d073805b72||Title:bluco0xhkgcjhda9n0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - cloud-racks@cloud-et-racks.tg [06/30/2026:08:47:05 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: cloud-racks@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 08:47:08 +0000] info [cpaneld] 167.99.236.81 - netmast "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d39ca1e1ce20a8601606c5c12a1cbd89aeda9ef6||Title:42t7el14dz0ypi||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9164e8a4095d855fcf4ad942e01d4368c6f669bb||Title:w6ax9wrlgjoewaa9g||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 08:48:02 +0000] info [webmaild] 102.176.253.226 - presidence@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.158.123.195
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cooperation-le-prof-robert-dussey-en-visite-de-travail-a-ndjamena/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.158.123.195
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/cooperation-le-prof-robert-dussey-en-visite-de-travail-a-ndjamena/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 108.59.4.208
country_id: 6252001
description:
2026-06-30 08:49:37 H=([108.59.4.208]) [108.59.4.208]:50001 F=<cxlo@white-ways.com> rejected RCPT <whiteway@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:18be5b4698f7361ab531b0b42f0541e7de3c5c2c||Title:dapavmryp4w85del||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93df2d710ccbca6a8a633692ed0563a3956b4167||Title:6263oxzt7j4yxk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9c04a0702bd2225a35a7abc693d1603613c930b||Title:pksrj4u76jt626||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@cloud-et-racks.tg [06/30/2026:08:51:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@cloud-et-racks.tg


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f70ae9e802151b64b861006f64ab21d9c70de34||Title:bgomvysjl0r8yni2iw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.121.103
country_id: 2635167
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.105.121.103||TA:198.105.121.103||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:047585b47e6634d6065ef72a8615ce6ae33cd89d||Title:13a6b1fqq9p3kp||RSV:8.21||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/30/2026:08:54:35 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:54:33 ns5 pure-ftpd[1652231]: (?@134.122.27.233) [WARNING] Authentication failed for user [yvwaocrr]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b23349556bbc7769a637985079562468c169dfdf||Title:f4oai52dgf111q9u4||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.20.185.144
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.20.185.144||TA:198.20.185.144||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:54:28 ns5 pure-ftpd[1652231]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - support@cloud-et-racks.tg [06/30/2026:08:55:09 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: support@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.214.144
country_id: 1168579
domain: www.corpsdiplomaticnews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.corpsdiplomaticnews.tghttp/www.corpsdiplomaticnews.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:99a8109f2f68bf89ca01be86bc9ca2145fb4eddb||Title:vb9urrmqs1lnr7kt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.228.194
country_id: 2077456
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:46.203.228.194||TA:46.203.228.194||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.214.144
country_id: 1168579
domain: www.corpsdiplomaticnews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.corpsdiplomaticnews.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.37.217.228
country_id: 953987
description:
2026-06-30 08:55:41 dovecot_login authenticator failed for H=(ADMIN) [102.37.217.228]:60916: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4100f1dea4a8266699c74c32720c37e419859211||Title:ndeko7udifeuvwhnt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4154471e116940d118b8860006e390577f6b3f43||Title:745g80swfb2kca7n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:58:09 ns5 pure-ftpd[1654003]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcf55b0283bb85450afa27ca43727f241645d007||Title:44gr6bdkbst0oxejtj||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 08:58:07 +0000] info [cpaneld] 64.111.92.123 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 08:58:15 ns5 pure-ftpd[1654005]: (?@134.122.27.233) [WARNING] Authentication failed for user [bighostingsnbd]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d7f8f88d868f2ff6dc9afbc423ebbd8cf68f71f||Title:rdkgtflsh1og29sxya||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:20ae065ef23030c6ce611d261cd088ad04bbe479||Title:olvhbxb5dyngjk99ag||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-30 09:00:03 +0000] info [webmaild] 196.171.46.177 - mawide@togointerim.net "GET /cpsess1553177919/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4331d7d4ed83171f758765d65f1926a1f3987dc9||Title:m07go1gzdaq0e0x||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-30 09:01:06 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-30 09:01:43 H=([77.83.39.59]) [77.83.39.59]:59970 F=<info@bluemarine-services.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aeb9e9e2387bccf64639b144bcbe296dd26d33df||Title:7en2y1exihwa3dvn3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.25
country_id: 6252001
description:
Jun 30 09:01:58 ns5 pure-ftpd[1655644]: (?@207.90.244.25) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:03:51 ns5 pure-ftpd[1656345]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-30 09:03:55 H=([77.83.39.59]) [77.83.39.59]:61694 F=<advising.service@advising.hsbc.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9bb8fb0838361cc92c5d90819f7ce5348c5ee31b||Title:j3lfvpk0x5ouryh||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.136.227.46
country_id: 3996063
description:
187.136.227.46 - - [30/Jun/2026:09:03:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212778&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-80011xetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810223 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-80011xetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.136.227.46


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.58.78.56
country_id: 1643084
description:
202.58.78.56 - - [30/Jun/2026:09:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118240&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-162202citems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810257 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-162202citems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.58.78.56


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.228.74
country_id: 1880251
description:
[2026-06-30 09:04:55 +0000] info [cpaneld] 129.212.228.74 - stephane "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c32ca1ec57960773098ceb4e4028cf8eb06e0e36||Title:w2tmpzq5z8crfbxok||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.23
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08d1448006474165ce1fd0f708d39efbcc96e902||Title:da46u1femvj44w8x6k||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:07:13 +0000] info [cpaneld] 64.111.92.123 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.92.137
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-09.89.124.92.137||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.106.51.102
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.106.51.102
country_id: 1527747
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:10:04 +0000] info [cpaneld] 64.111.92.123 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.55
country_id: 6252001
description:
205.169.39.55 - - [30/Jun/2026:09:11:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055882&pdata=http%253A%252F%252Fsocial-infos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810699 HTTP/1.1" 302 0 social-infos.tg "http://social-infos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.206
country_id: 298795
description:
Jun 30 09:11:36 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.65.193.96
country_id: 1643084
description:
2026-06-30 09:14:46 dovecot_plain authenticator failed for H=(localhost) [179.65.193.96]:1353: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.49
country_id: 6252001
description:
205.169.39.49 - - [30/Jun/2026:09:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974619&pdata=http%253A%252F%252Fjlkjum.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810909 HTTP/1.1" 302 0 jlkjum.mediatopnews.tg "http://jlkjum.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [30/Jun/2026:09:15:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132072&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782810911 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [30/Jun/2026:09:19:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051370&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782811194 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.12
country_id: 3469034
description:
Jun 30 09:22:50 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.38.37
country_id: 6252001
domain: mail.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.worldinfo.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:24:46 +0000] info [whostmgrd] 80.248.64.198 - root "GET /cpsess6495117563/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [102.64.162.100] != Current IP Address [80.248.64.198]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.250.204.211
country_id: 3144096
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.250.204.211||TA:104.250.204.211||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:26:55 +0000] info [cpaneld] 64.111.92.123 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 09:28:37 +0000] info [webmaild] 160.242.195.10 - hboroze@caissederetraites.tg "POST /cpsess3580956980/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.64.164.131] != Current IP Address [160.242.195.10]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:32:22 +0000] info [whostmgrd] 80.248.64.198 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:32:22 +0000] info [whostmgrd] 80.248.64.198 PURGE root:2KVkxuTQ8NFMq9SR badpass [user password incorrect]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:32:13 ns5 pure-ftpd[1672294]: (?@134.122.27.233) [WARNING] Authentication failed for user [esso]


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-30 09:32:46 +0000] info [whostmgrd] 80.248.64.198 NEW root:GdGEr8hvMTtb9gHC address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.253.16.227
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:167.253.16.227||TA:167.253.16.227||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:32:08 ns5 pure-ftpd[1672279]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:33:28 +0000] info [cpaneld] 64.111.92.123 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.50
country_id: 798544
description:
Jun 30 09:34:05 ns5 auth[991507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.38.156.78
country_id: 798544
description:
45.38.156.78 - - [30/Jun/2026:09:35:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120643&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Fme-eric-sossa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812128 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/me-eric-sossa/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.8513.1583 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.38.156.78


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 91.247.163.183
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:p||MV:33' UNION SELECT NULL-- -||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 91.247.163.183
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_HEADERS:Referer||MV:https://cafe.tg/?p=33' UNION SELECT NULL-- -||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.135.175.190
country_id: 6252001
description:
43.135.175.190 - - [30/Jun/2026:09:37:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868182&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F07%252F10%252Ftogo-la-cedeao-prend-acte-de-ladoption-de-la-nouvelle-constitution-et-lance-un-appel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812239 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2024/07/10/togo-la-cedeao-prend-acte-de-ladoption-de-la-nouvelle-constitution-et-lance-un-appel/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.135.175.190


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.203
country_id: 1880251
description:
43.172.198.203 - - [30/Jun/2026:09:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658963&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526cat%253D8&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812331 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&cat=8" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 09:38:14 +0000] info [cpaneld] 167.99.236.81 - tresorerie "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.0.60.217
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-38.200.0.60.217||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.120.45
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-38.138.219.120.45||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:38:55 +0000] info [cpaneld] 64.111.92.123 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [30/Jun/2026:09:38:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923438&pdata=http%253A%252F%252Fxl6zcp.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812299 HTTP/1.1" 302 0 xl6zcp.mediatopnews.tg "http://xl6zcp.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:40:14 +0000] info [cpaneld] 64.111.92.123 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.61.203
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-bidc-et-afriland-first-bank-ci-concluent-un-partenariat-de-10-milliards-fcfa-pour-soutenir-la-croissance-des-pme-en-cote-divoire/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.61.203
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-bidc-et-afriland-first-bank-ci-concluent-un-partenariat-de-10-milliards-fcfa-pour-soutenir-la-croissance-des-pme-en-cote-divoire/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [30/Jun/2026:09:42:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657643%26pdata=http://www.lasnbtg.snb.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1782812556 HTTP/1.1" 404 561 www.lasnbtg.snb.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:41:57 ns5 pure-ftpd[1680645]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [30/Jun/2026:09:46:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855577&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812783 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [30/Jun/2026:09:46:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171685&pdata=https%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782812814 HTTP/2.0" 302 0 confortis.tg "https://confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:47:57 +0000] info [cpaneld] 64.111.92.123 - admin@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 165.99.196.21
country_id: 1210997
domain: anamek.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23017.anamek.tg||ServerName:anamek.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c39a24be7cdc9f6a91b02d7033d6a22b804de314||Title:0xdc778f2a||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.94.66.213
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.94.66.213: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 09:50:04 +0000] info [cpaneld] 20.212.169.175 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [30/Jun/2026:09:50:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128936&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813034 HTTP/1.1" 302 0 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 09:50:39 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.255.126
country_id: 2562770
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.202.255.126||TA:142.202.255.126||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.188
country_id: 3175395
description:
Jun 30 09:52:04 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.188 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.56
country_id: 1880251
description:
43.173.180.56 - - [30/Jun/2026:09:55:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132329&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D5776&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813300 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=5776" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.56


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 09:56:39 +0000] info [cpaneld] 167.99.236.81 - wifizoneuser "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:56:31 ns5 pure-ftpd[1687548]: (?@134.122.27.233) [INFO] New connection from 134.122.27.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 30 09:56:36 ns5 pure-ftpd[1687548]: (?@134.122.27.233) [WARNING] Authentication failed for user [wifizoneuser]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [30/Jun/2026:09:56:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068906&pdata=http%253A%252F%252Fywxmm6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813399 HTTP/1.1" 302 0 ywxmm6.mediatopnews.tg "http://ywxmm6.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.17
country_id: 6252001
description:
205.169.39.17 - - [30/Jun/2026:09:56:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052040&pdata=http%253A%252F%252Fxhhehr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813410 HTTP/1.1" 302 0 xhhehr.mediatopnews.tg "http://xhhehr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.17


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 20.223.54.57
country_id: 2963597
description:
20.223.54.57 - - [30/Jun/2026:09:57:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736743&pdata=http%253A%252F%252Farse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813427 HTTP/1.1" 302 0 arse.tg "http://arse.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:20.223.54.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 09:58:26 +0000] info [cpaneld] 64.111.92.123 - https "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user https (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.96.221.135
country_id: 2077456
description:
[2026-06-30 09:59:44 +0000] info [cpaneld] 27.96.221.135 - ayhhhyhk "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.219
country_id: 1880251
description:
43.173.175.219 - - [30/Jun/2026:09:59:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937927&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Ful-voici-les-nouveaux-directeurs-et-doyens-des-etablissements%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813541 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/a-la-une/ul-voici-les-nouveaux-directeurs-et-doyens-des-etablissements/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.219


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.255.12
country_id: 2562770
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.202.255.12||TA:142.202.255.12||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.35.178
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.239.35.178||TA:104.239.35.178||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 10:00:05 +0000] info [cpaneld] 64.111.92.123 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.130.217.39
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 195.130.217.39: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.152
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:142.147.132.152||TA:142.147.132.152||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.121.125
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.37.121.125||TA:198.37.121.125||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [30/Jun/2026:10:03:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881450&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813778 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.181.85
country_id: 1327865
description:
2026-06-30 10:04:00 dovecot_plain authenticator failed for H=(localhost) [103.172.181.85]:22155: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [30/Jun/2026:10:04:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738140&pdata=http%253A%252F%252Flasnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813847 HTTP/1.1" 302 0 lasnb.tg "http://lasnb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-30 10:04:20 +0000] info [webmaild] 160.242.195.10 - hboroze@caissederetraites.tg "POST /cpsess0754317515/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.64.164.131] != Current IP Address [160.242.195.10]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [30/Jun/2026:10:05:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989527&pdata=http%253A%252F%252Fwww.lasnbtg.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813929 HTTP/1.1" 302 0 www.lasnbtg.snb.tg "http://www.lasnbtg.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.63.128.4
country_id: 1861060
description:
72.63.128.4 - - [30/Jun/2026:10:06:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946520&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fliste%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782813958 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/liste/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.3038.1188 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.63.128.4


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.77.223.228
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.77.223.228||TA:185.77.223.228||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.87.253
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/journee-du-1er-juin-a-la-snb HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.193
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.old||User:cloudetracks||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 83.142.52.53
country_id: 294640
domain: cafe.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:wpforms[fields][6]||MV:1' UNION SELECT NULL-- -||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [30/Jun/2026:10:11:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266278&pdata=http%253A%252F%252Fjvvtdy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814253 HTTP/1.1" 302 0 jvvtdy.mediatopnews.tg "http://jvvtdy.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jun 30 10:14:47 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.120.41
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.120.120.41||TA:172.120.120.41||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.25
country_id: 1880251
description:
43.173.174.25 - - [30/Jun/2026:10:15:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039592&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D1%2526page%253D106&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814535 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=1&page=106" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.25


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.205.207.11
country_id: 290557
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-bitter-lemon-by-chap HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.225.187.6
country_id: 1643084
description:
2026-06-30 10:15:10 dovecot_login authenticator failed for H=fast-internet-43-225-187-6.solnet.net.id (Bijiorkas-MacBook-Pro.local) [43.225.187.6]:58920: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.10.85
country_id: 1269750
description:
Jun 30 10:15:44 ns5 auth[1679858]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.10.85 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.235.102
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.235.102||TA:45.147.235.102||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 10:16:19 +0000] info [cpaneld] 167.99.236.81 - ayhhhyhk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
country_id: 1880251
description:
47.128.121.174 - - [30/Jun/2026:10:16:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606505&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fministre-des-medias%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814615 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/ministre-des-medias/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.165.163
country_id: 2077456
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.112.165.163||TA:92.112.165.163||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.70.39.83
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 3.70.39.83: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.64.19.207
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 3.64.19.207: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 63.176.24.131
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 63.176.24.131: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.103.232
country_id: 458258
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.131.103.232||TA:45.131.103.232||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.98.168.124
country_id: 2921044
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.98.168.124||TA:172.98.168.124||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 63.178.154.74
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 63.178.154.74: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.101.238
country_id: 458258
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.131.101.238||TA:45.131.101.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.165.231
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:217.117.165.231||TA:217.117.165.231||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.16.252
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.16.252||TA:152.232.16.252||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.166
country_id: 2077456
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:202.155.186.166||TA:202.155.186.166||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.103.30
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.103.30||TA:152.232.103.30||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.97
country_id: 1880251
description:
43.173.180.97 - - [30/Jun/2026:10:19:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128212&pdata=http%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782814770 HTTP/1.1" 404 561 dagl.tg "http://dagl.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.97


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.196.219
country_id: 2542007
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ihpc-flambee-des-produits-frais-recul-des-cereales-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 10:19:44 +0000] info [cpaneld] 167.99.236.81 - k.eklou "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.196.219
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ihpc-flambee-des-produits-frais-recul-des-cereales-au-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.237.102.139
country_id: 2750405
description:
[2026-06-30 10:22:57 +0000] info [cpaneld] 185.237.102.139 NEW conforwellty:Lgi4gN23kc4KDSyK address=185.237.102.139,app=cpaneld,creator=conforwellty,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [30/Jun/2026:10:25:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923015&pdata=http%253A%252F%252Fsp-eau.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815100 HTTP/1.1" 302 0 sp-eau.tg "http://sp-eau.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.5
country_id: 6251999
description:
[2026-06-30 10:26:00 +0000] info [cpaneld] 195.63.16.5 - cafeitadm "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.153.194.188
country_id: 1880251
description:
43.153.194.188 - - [30/Jun/2026:10:26:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055326&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fitalie-giorgia-meloni-devoile-son-plan-pour-lafrique%252F%253Famp%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815171 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/italie-giorgia-meloni-devoile-son-plan-pour-lafrique/?amp=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.153.194.188


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.116.132
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.37.116.132||TA:198.37.116.132||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [30/Jun/2026:10:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039847&pdata=https%253A%252F%252Fblitta1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815312 HTTP/2.0" 302 0 blitta1.mairie.tg "https://blitta1.mairie.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.222.174.47
country_id: 2661886
description:
104.222.174.47 - - [30/Jun/2026:10:31:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118227&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ftag%252Ffndc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782815471 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/tag/fndc/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.1603.1139 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.222.174.47


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.39
country_id: 1643084
description:
[2026-06-30 10:31:45 +0000] info [cpaneld] 157.66.56.39 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 47.251.74.98
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.40.126
country_id: 3469034
domain: www.u.inh.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u.inh.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


