# incident

plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.11.247
country_id: 2363686
description:
[2026-07-02 17:15:41 +0000] info [webmaild] 196.169.11.247 - kanku@caissederetraites.tg "POST /cpsess2883701488/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [196.169.11.247]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [02/Jul/2026:17:16:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859220&pdata=http%253A%252F%252F154.70.82.249%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783012604 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.166
country_id: 6252001
description:
[2026-07-02 17:16:23 +0000] info [cpaneld] 64.44.59.166 NEW formationfreenet:4UGaP4ENgAmay2LK address=64.44.59.166,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.116.182.234
country_id: 294640
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/50.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.198.105.7
country_id: 1269750
domain: wages.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/aopsacai/public_html/wp-includes/SimplePie/about.php||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.105.7
country_id: 1269750
domain: wages.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/index.php||SC:/home/aopsacai/public_html/images||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.177.177
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/restaurant/opera/pizza/royale/?add-to-cart=3540||QS:add-to-cart=3540||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.198.105.7
country_id: 1269750
domain: wages.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/aopsacai/public_html/wp-includes/SimplePie/index.php||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.105.7
country_id: 1269750
domain: wages.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/aopsacai/public_html/wp-admin/images/about.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.198.105.7
country_id: 1269750
domain: letabloid.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pnlpzmfv/public_html/wp-includes/SimplePie/about.php||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.105.7
country_id: 1269750
domain: letabloid.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/index.php||SC:/home/pnlpzmfv/public_html/images||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.198.105.7
country_id: 1269750
domain: letabloid.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pnlpzmfv/public_html/wp-includes/SimplePie/index.php||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.105.7
country_id: 1269750
domain: letabloid.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/pnlpzmfv/public_html/wp-admin/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-02 17:20:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:25070: 535 Incorrect authentication data (set_id=req)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.208.22.56
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.105.7
country_id: 1269750
domain: letabloid.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/pnlpzmfv/public_html/wp-admin/images/about.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.126.30
country_id: 2017370
description:
[2026-07-02 17:22:22 +0000] info [cpaneld] 45.148.126.30 - crepsad "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.105.7
country_id: 1269750
domain: bawasongroup.tchambainvest.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/waywcbyw/public_html/bawasson/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.198.105.7
country_id: 1269750
domain: bawasongroup.tchambainvest.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/waywcbyw/public_html/bawasson/wp-includes||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.232.219
country_id: 294640
description:
[2026-07-02 17:23:47 +0000] info [cpaneld] 45.148.232.219 - cloudetracks "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.19.90.230
country_id: 241170
description:
[2026-07-02 17:23:48 +0000] info [cpaneld] 146.19.90.230 - OgouStephane "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user OgouStephane (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.173.209.105
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.224.39.68
country_id: 3625428
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.114
country_id: 1880251
description:
[2026-07-02 17:27:00 +0000] info [cpaneld] 104.28.166.114 - masfloy "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user masfloy) has locked out IP 104.28.166.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.114
country_id: 1880251
description:
[2026-07-02 17:27:46 +0000] info [cpaneld] 104.28.166.114 - stephane "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 104.28.166.114
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[154.70.82.246] [Local Port]=[2083] [Remote IP Address]=[104.28.166.114] [Remote Port]=[9455] [Authentication Database]=[system] [Username]=[masfloy] (1/30 failures) (blocked until [Fri Jul  3 17:27:00 2026 UTC/Fri Jul  3 17:27:00 2026 LOCAL])


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.60.221
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/index.php||SC:/home/dxsiclpd/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.51
country_id: 6252001
domain: bierehofbraeu.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/bierehofbraeu.snb.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.212.60.221
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dxsiclpd/public_html/wp-includes/SimplePie/about.php||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.114
country_id: 1880251
description:
[2026-07-02 17:29:59 +0000] info [cpaneld] 104.28.166.114 - e.sanvee "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 150.249.248.105
country_id: 1861060
domain: ekeasarl.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.60
country_id: 1880251
description:
47.128.121.60 - - [02/Jul/2026:17:29:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051625&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F119%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783013343 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/119/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.60


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.60.221
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/dxsiclpd/public_html/wp-admin/images/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.207.193.125
country_id: 290557
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-covid-19-linconscience-de-certains-expose-les-autres-au-risque-de-contamination/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.212.60.221
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/dxsiclpd/public_html/wp-includes/SimplePie/index.php||RSV:8.23||T:APACHE||


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 104.28.166.114
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[154.70.82.246] [Local Port]=[2083] [Remote IP Address]=[104.28.166.114] [Remote Port]=[11524] [Authentication Database]=[system] [Username]=[e.sanvee] (1/30 failures) (blocked until [Fri Jul  3 17:29:59 2026 UTC/Fri Jul  3 17:29:59 2026 LOCAL])


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.207.193.125
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-covid-19-linconscience-de-certains-expose-les-autres-au-risque-de-contamination/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 17:31:22 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-02 17:31:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:11551: 535 Incorrect authentication data (set_id=pg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.188.33
country_id: 2017370
description:
[2026-07-02 17:31:43 +0000] info [cpaneld] 95.26.188.33 - kidsedunetmaster "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.60
country_id: 1880251
description:
47.128.121.60 - - [02/Jul/2026:17:31:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591946&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F122%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783013511 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/122/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.60


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.194.14.38
country_id: 3624060
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/2015/05/11/sanele-xabaa-model-uniquely-set-to-conquer-the-world/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.60.221
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/dxsiclpd/public_html/wp-admin/images/about.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.187.196.85
country_id: 357994
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2024/04/05/les-meilleurs-matchs-en-angleterre-et-une-grande-annonce-en-league-1-1xbet-revele-les-principaux-matchs-de-la-semaine/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.85
country_id: 3996063
description:
Jul  2 17:32:30 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.43.180.196
country_id: 614540
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-34.94.43.180.196||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.217.122
country_id: 2363686
description:
102.64.217.122 - - [02/Jul/2026:17:35:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987271&pdata=https%253A%252F%252Fwages.tg%252Frecrutement-stage%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783013702 HTTP/2.0" 302 0 wages.tg "https://wages.tg/recrutement-stage/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.217.122


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.174.58.242
country_id: 6252001
domain: zephyr.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.43.180.196
country_id: 614540
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-36.94.43.180.196||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.62.193
country_id: 1210997
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.155.129.51
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.204.150
country_id: 2363686
description:
2026-07-02 17:37:37 H=([10.47.134.97]) [196.168.204.150]:31622 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<nicaise.dejean@dagl.tg> A=dovecot_plain:nicaise.dejean@dagl.tg temporarily rejected RCPT <abadjene@yahoo.fr>: host lookup did not complete


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.94.122.242
country_id: 6252001
domain: nps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.0 Safari/537.36||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jul  2 17:40:34 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-07-02 17:41:56 +0000] info [cpaneld] 5.230.133.223 NEW formationfreenet:27ZDRAYdcxAQkhlM address=5.230.133.223,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.192.115
country_id: 2363686
description:
[2026-07-02 17:41:04 +0000] info [webmaild] 196.168.192.115 - secre.gene@ucao-uut.tg "POST /cpsess4888615552/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.176.253.226] != Current IP Address [196.168.192.115]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [02/Jul/2026:17:41:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446232&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Ff88a609383d0bb0d56f82f4d4e0d2cbc%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783014106 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/f88a609383d0bb0d56f82f4d4e0d2cbc/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-02 17:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:16371: 535 Incorrect authentication data (set_id=sylvester)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 17:42:18 H=([127.0.0.1]) [161.35.78.120]:52470 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <solim.passou@somane.net>: host lookup did not complete


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 17:43:35 H=([127.0.0.1]) [161.35.78.120]:57290 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <solim.passou@somane.net>: host lookup did not complete


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.192.115
country_id: 2363686
description:
[2026-07-02 17:44:49 +0000] info [webmaild] 196.168.192.115 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 17:44:38 H=([127.0.0.1]) [161.35.78.120]:45194 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<documentation@dgdn-togo.tg> A=dovecot_login:contact@dgdn-togo.tg temporarily rejected RCPT <solim.passou@somane.net>: host lookup did not complete


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.91.210.75
country_id: 587116
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/special-journee-de-de-don-de-sang HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 98.178.72.30
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-45.98.178.72.30||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.148.126.102
country_id: 6252001
description:
16.148.126.102 - - [02/Jul/2026:17:45:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984854&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252F2472c979c209f4210eb90f3ec0789f65%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783014302 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/2472c979c209f4210eb90f3ec0789f65/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.148.126.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-02 17:45:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:22004: 535 Incorrect authentication data (set_id=cp-ht-11)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.126.23.52
country_id: 1210997
description:
103.126.23.52 - - [02/Jul/2026:17:46:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713491&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F128%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783014382 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/128/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.9725.1565 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.126.23.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-02 17:46:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:18341: 535 Incorrect authentication data (set_id=cp-ht-11)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 68.71.249.153
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-46.68.71.249.153||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 174.75.211.222
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-45.174.75.211.222||RSV:8.23||T:APACHE||


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul  2 17:47:17 ns5 sshd[3824076]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.72.196.75
country_id: 1643084
description:
2026-07-02 17:47:31 dovecot_login authenticator failed for H=([1.227.135.190]) [202.72.196.75]:55515: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
country_id: 1835841
description:
Jul  2 17:48:00 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul  2 17:48:17 ns5 sshd[3824550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.80.80
country_id: 1861060
description:
2026-07-02 17:54:42 dovecot_login authenticator failed for H=v150-95-80-80.a011.g.bkk1.static.cnode.io (150-95-27-109.plesk.page) [150.95.80.80]:44454: 535 Incorrect authentication data (set_id=support.technique@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-07-02 17:57:02 dovecot_login authenticator failed for H=(DESKTOPORGRALV) [196.170.122.162]:62945: 535 Incorrect authentication data


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.45
country_id: 6252001
description:
Jul  2 17:57:57 ns5 pure-ftpd[3829726]: (?@147.185.132.45) [INFO] New connection from 147.185.132.45


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [02/Jul/2026:18:00:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805508&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783015218 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.201
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:45.147.232.201||TA:45.147.232.201||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.121.126
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/rencontre-trimestrielle-societe-nouvelle-de-boissons-et-partenaires HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-02 18:05:27 +0000] info [cpaneld] 196.171.46.177 NEW togoinrdceh:6ULekDGhQ5kq_7Qg address=196.171.46.177,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - richard.attiogbe@togointerim.net [07/02/2026:18:06:55 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: richard.attiogbe@togointerim.net


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 74.244.135.227
country_id: 3865483
description:
74.244.135.227 - - [02/Jul/2026:18:08:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052183&pdata=https%253A%252F%252Fdirect7.tg%252F%253Fp%253D10067&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783015732 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/?p=10067" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.244.135.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.61
country_id: 3175395
description:
Jul  2 18:08:58 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.136.141.124
country_id: 934292
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/construction-le-togo-impose-de-nouvelles-normes-cimentieres/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 94.103.188.229
country_id: 617790
domain: cfpj.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.7827.55 Safari/537.36||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.231.8.218
country_id: 2378080
domain: lcr-adem.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15998.lcr-adem.org||ServerName:lcr-adem.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57d29a57b6f8ea40b944c23048c2046df130543b||Title:0x187dd9a6||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.16.121
country_id: 2363686
description:
[2026-07-02 18:09:55 +0000] info [cpaneld] 196.171.16.121 NEW vejjghdd:tZHmKSps42Ur03Tx address=196.171.16.121,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.61
country_id: 3175395
description:
Jul  2 18:09:04 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.16.121
country_id: 2400553
domain: www.brmn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [07/02/2026:18:12:32 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 72.94.116.41
country_id: 6252001
domain: tokcryl.com.br
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/images/cache.php||SC:/var/www/html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: toke77.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/toke77.net/images/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokai-seiki.co.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokai-seiki.co.jp/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 72.94.116.41
country_id: 6252001
domain: tokeikizoku.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/images/images/images/images/cache.php||SC:/var/www/html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 72.94.116.41
country_id: 6252001
domain: tokgirls.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/images/images/cache.php||SC:/var/www/html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 72.94.116.41
country_id: 6252001
domain: tokei-ueno.jp
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/images/images/images/cache.php||SC:/var/www/html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokachi-table.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokachi-table.com/cache/cache/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: s169.goserver.host
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/s169.goserver.host/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokaigas.co.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokaigas.co.jp/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokfibra.com.br
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokfibra.com.br/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokatyapragi.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokatyapragi.com/wp-content/plugins/plugins/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokcryl.com.br
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokcryl.com.br/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokati1829.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokati1829.net/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokgozmadencilik.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokgozmadencilik.com/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokaisakura.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokaisakura.jp/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: ik14001.mixhost.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ik14001.mixhost.jp/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokai3r.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokai3r.org/wp-content/plugins/plugins/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokinomori-hokkaido.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokinomori-hokkaido.com/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokathaberajansi.com.tr
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokathaberajansi.com.tr/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokgirls.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokgirls.com/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokei-ueno.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokei-ueno.jp/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 72.94.116.41
country_id: 6252001
domain: toke77.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/images/images/images/images/images/images/cache.php||SC:/var/www/html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokenwin3.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokenwin3.com/wp-content/plugins/plugins/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 72.94.116.41
country_id: 6252001
domain: tokinomori-hokkaido.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/images/images/images/images/images/cache.php||SC:/var/www/html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: ik12003.mixhost.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ik12003.mixhost.jp/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: ik10003.mixhost.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ik10003.mixhost.jp/cache/cache/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokeikizoku.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokeikizoku.com/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: www.tokobesibajaterdekat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tokobesibajaterdekat.com/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: toklike.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/toklike.com/wp-content/plugins/plugins/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: toko8888.co.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/toko8888.co.jp/images/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokofthetown.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokofthetown.com/images/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokkimaster.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokkimaster.in/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 72.94.116.41
country_id: 6252001
domain: tokofatima.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/assets/images/images/cache.php||SC:/var/www/html/assets||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokkin-holdings.co.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokkin-holdings.co.jp/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokoakiilhambattery.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokoakiilhambattery.com/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokidokimie-sun.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokidokimie-sun.com/images/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: ip-api.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ip-api.com/json?fields=66842623 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: toko-aki-bandung.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/toko-aki-bandung.com/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokenengenharia.com.br
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokenengenharia.com.br/assets/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokocandrapadli.store
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokocandrapadli.store/blogs/media/media/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokododel.store
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokododel.store/images/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokk.com.br
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokk.com.br/assets/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokoakiterdekat.co.id
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokoakiterdekat.co.id/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokjoin.online
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokjoin.online/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokachi-pd.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokachi-pd.jp/wp-content/plugins/plugins/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: toki.nara.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/toki.nara.jp/assets/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokimekilog.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokimekilog.com/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokofatima.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokofatima.com/assets/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokobesibajaterdekat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokobesibajaterdekat.com/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: tokiyskie-mstitelli-lordfilm.ru
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tokiyskie-mstitelli-lordfilm.ru/wp-content/plugins/plugins/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.116.41
country_id: 6252001
domain: toko-etawalin.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/toko-etawalin.com/assets/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ingersarlu@inger.tg [07/02/2026:18:18:20 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ingersarlu@inger.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.189.30
country_id: 99237
description:
Jul  2 18:24:18 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.189.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.121
country_id: 3469034
description:
Jul  2 18:24:47 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.69
country_id: 3469034
description:
Jul  2 18:29:25 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.126.236.253
country_id: 6252001
domain: ese2i.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/vodvpozo/public_html/wp-admin/images/index.php||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.135.139.165
country_id: 6252001
domain: lerendez-vous.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/index.php/wp-json/wp/v2/users/1||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 216.126.236.253
country_id: 6252001
domain: ese2i.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/vodvpozo/public_html/wp-includes/SimplePie/Content||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.224.92.82
country_id: 2635167
domain: ameak.co
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:506471||Sizes:18211||Combined size:18211||User:ubwmytwf||WPU:||Filename:BDKR28_zxirig.zip||Scanned:/tmp//20260702-183610-akavmZNxuzdXXBFWLj88CQAAAAs-file-UuYsRR||SC:/home/ubwmytwf/public_html/index.php||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.83.182
country_id: 6251999
description:
[2026-07-02 18:39:12 +0000] info [whostmgrd] 217.181.83.182 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-07-02 18:40:35 +0000] info [cpaneld] 5.230.153.23 - kygyhxkc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.149.54
country_id: 1814991
domain: belali.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.74.207.221
country_id: 2542007
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/sponsoring HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 141.98.11.224
country_id: 597427
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:18-42.141.98.11.224||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.41
country_id: 3469034
description:
Jul  2 18:43:09 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jul  2 18:44:46 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 147.90.209.148
country_id: 2921044
domain: atms.tg
description:
IM360 WAF: Block .suspected files||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.182
country_id: 3175395
description:
Jul  2 18:45:10 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.98.109.173
country_id: 290557
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/event/adzinikuzan-2023-apotheose HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.104.18
country_id: 2464461
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/djama-pilsner HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.127.162.228
country_id: 3351879
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/les-prix-des-produits-snb-restent-inchanges HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jul  2 18:54:14 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 18:55:02 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.165.157
country_id: 2363686
description:
[2026-07-02 18:55:17 +0000] info [cpaneld] 102.64.165.157 - mvfxewjz "GET /cpsess1111874592/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.165.157]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.110.173
country_id: 2363686
description:
[2026-07-02 18:57:13 +0000] info [webmaild] 196.171.110.173 - brightfiaga@ciieeinternational.org "POST /cpsess4312561652/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.37.173
country_id: 3469034
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/scoring.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.69
country_id: 1880251
description:
43.173.174.69 - - [02/Jul/2026:18:58:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856873&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D9682&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783018703 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=9682" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.220.89.104
country_id: 3469034
description:
2026-07-02 19:02:50 dovecot_plain authenticator failed for H=([10.5.0.2]) [179.220.89.104]:40410: 535 Incorrect authentication data (set_id=newsletter@togointerim.net)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.55.127
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:162.252.55.127||TA:162.252.55.127||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.2.102
country_id: 1562822
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/audiences.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.40.172
country_id: 3865483
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/informatique.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.105.201
country_id: 99237
domain: www.vitrinenews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.200.31.165
country_id: 614540
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/recherchedeveloppement.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.45
country_id: 6252001
description:
205.169.39.45 - - [02/Jul/2026:19:09:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379565&pdata=https%253A%252F%252Fversion.mesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783019363 HTTP/2.0" 302 0 version.mesyscom.com "https://version.mesyscom.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.45


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - madila.boutoma@togointerim.net [07/02/2026:19:10:43 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: madila.boutoma@togointerim.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.144.220
country_id: 337996
domain: www.vitrinenews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vitrinenews.tghttp/www.vitrinenews.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - richard.attiogbe@togointerim.net [07/02/2026:19:11:13 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: richard.attiogbe@togointerim.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.244.97.251
country_id: 6254930
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/datamining.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - direction@togointerim.net [07/02/2026:19:12:13 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: direction@togointerim.net


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:39dbed44c01fd86daa74ff76c7be2eb5c2fb6d9e||Title:i46612oycd4kdx5va||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.99
country_id: 1269750
description:
Jul  2 19:17:44 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:877b32a3c9482149a6cda4d28bd6c1677923cd90||Title:7pjpgex5fky52tlm||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 19:19:45 +0000] info [cpaneld] 172.111.157.143 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:113c1565d5e2bd052ef7cdc6c94d9c2346e0fed6||Title:6hdgnydk19rohv||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe748520a6294f70db2104adebd11aa4fc1627ee||Title:gzdjdp567s8sepaeud||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f91a448b2615a915a2820469e5d449cfcc5e07e9||Title:p336bbya1r3eir19||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8d13533669a780c8adc777747ad3f75d087156b||Title:uwoeysmiigvsps6||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce75a4667e95c26614181a7ef9ee0428911ebdc7||Title:vyxmvs97f1x67gq54n||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.120.161
country_id: 732800
description:
2026-07-02 19:23:26 H=([91.92.120.161]) [91.92.120.161]:54603 F=<contact@sthandling-aero.tg> rejected RCPT <contact@sthandling-aero.tg>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.72.20
country_id: 2363686
description:
[2026-07-02 19:24:14 +0000] info [webmaild] 80.248.72.20 - support@cloud-et-racks.tg "POST /cpsess5740699721/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [80.248.72.20]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f6699969efc2379a715ed5ec321fd3cc8792ea4e||Title:yusp1ncnq80utm3||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.11.247
country_id: 1831722
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/reunion-trimestrielle-societe-nouvelle-de-boissons-et-task-forces HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c5d7782941e24803bf23500c54e03d956ed99ee||Title:sy0pb9xbftaifa1y04||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.112.216.57
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/investissement-agricole-une-cellule-pour-garantir-un-climat-foncier-securise/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83c5742b54f91a9de02d910ed69a739af784f365||Title:7f4imusg8o4nbd3||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.137
country_id: 3469034
description:
Jul  2 19:26:29 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.112.216.57
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/investissement-agricole-une-cellule-pour-garantir-un-climat-foncier-securise/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77e4144e72376adcae8c465fc8e843a79d5de6ff||Title:e29d80cjauxr8oyhdw||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1dc12ecce891ac127543b2540dcb0c1a8d69c77||Title:rwokwctnl26pk36||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.241
country_id: 3865483
description:
Jul  2 19:29:54 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:27caa39ed9f18ce75241b153b0a8e2faf8d5b066||Title:5hict78uvse26jhz||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.241
country_id: 3865483
description:
Jul  2 19:30:08 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:143e1be8410fe4e6db202bdab411786f3683a133||Title:cvk1w0v6ubfexhk2f||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.240.40
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.245.240.40||TA:104.245.240.40||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b716f36662c3968a10d62164a9d7c9f7d9fb2448||Title:2e2tbnsx6mylce||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.56.146
country_id: 1694008
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a90aa515b69627d851f73b64be230055208c63a7||Title:4cuq13k74wb6xv4p||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 19:32:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43038: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.110.55.208
country_id: 3923057
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/ceremonie-de-lancement-officiel-djama-228 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 19:36:21 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.241.138
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.15.196.117
country_id: 2464461
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/resultats-provisoires-denis-sassou-nguesso-reelu-avec-plus-de-94/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.206.13
country_id: 290557
domain: sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sthandling-aero.tg:80/img-sys/server_misconfigured.png HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.241.138
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.15.196.117
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/resultats-provisoires-denis-sassou-nguesso-reelu-avec-plus-de-94/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.252.120
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:172.83.252.120||TA:172.83.252.120||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.91.78.186
country_id: 2328926
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/16.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 19:41:14 +0000] info [cpaneld] 172.111.157.143 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.62.163.158
country_id: 6252001
description:
[2026-07-02 19:46:58 +0000] info [whostmgrd] 68.62.163.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.34.233
country_id: 6252001
domain: stephane.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/stephane.free.netmaster.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.240.217.86
country_id: 2589581
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/36.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.177.114.160
country_id: 6252001
description:
[2026-07-02 19:49:37 +0000] info [cpaneld] 64.177.114.160 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.177.114.160
country_id: 6252001
description:
[2026-07-02 19:50:28 +0000] info [cpaneld] 64.177.114.160 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul  2 19:52:28 ns5 sshd[3884505]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.153.57.87
country_id: 6252001
description:
[2026-07-02 19:55:38 +0000] info [whostmgrd] 164.153.57.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.163.236
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/7 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [02/Jul/2026:19:56:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078099&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783022165 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.162.26
country_id: 2363686
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/jeu-capsules-consommateurs-remise-lots-1 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 19:58:25 +0000] info [cpaneld] 172.111.157.143 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.163.139
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/djama-228 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.81.107.116
country_id: 6252001
description:
[2026-07-02 20:01:03 +0000] info [whostmgrd] 162.81.107.116 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.230.43.125
country_id: 3489940
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/mediation-africaine-des-orientations-strategiques-pour-le-second-semestre-2026/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.230.43.125
country_id: 3489940
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/mediation-africaine-des-orientations-strategiques-pour-le-second-semestre-2026/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.78
country_id: 2635167
description:
[2026-07-02 20:05:05 +0000] info [cpaneld] 5.230.133.78 - zmfpejke "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User zmfpejke has their account suspended. Login blocked.


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 20.46.178.180
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:167') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 20.46.178.180
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:167') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 20.46.178.180
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:p||MV:details-envenement/**//**/or/**/1/**/group/**/by/**/concat(0x3852516c,(select/**/(elt(2836=2836,1))),0x4a63626e,floor(rand(0)*2))/**/having/**/min(0)#||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77211700
name: IM360 WAF: Detects conditional SQL injection attempts
abuser: 20.46.178.180
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Detects conditional SQL injection attempts||RSV:8.23||T:APACHE||MVN:MATCHED_VAR||MV:details-envenement/**//**/OR/**/1/**/GROUP/**/BY/**/CONCAT(0x3852516c,(SELECT/**/(ELT(2836=2836,1))),0x4a63626e,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)#||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 20.46.178.180
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Malformed URI Open Redirect Probe Detected||MV:/?id=167&p=details-envenement/**//**/OR/**/(SELECT/**/2*(IF((SELECT/**/*/**/FROM/**/(SELECT/**/CONCAT(0x586a4c70,(SELECT/**/(ELT(2836=2836,1))),0x6f745157))s),/**/8446744073709551610,/**/8446744073709551610)))||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 20.46.178.180
country_id: 1861060
domain: cloud-et-racks.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=4916||QS:add-to-cart=4916||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 20.46.178.180
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:167') and 1=1 union all select 1,null,'<script>alert(\"xss\")</etc/passwd')#||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 20.46.178.180
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Possible XSS in arguments||MV:167') and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 158.173.158.137
country_id: 3017382
description:
[2026-07-02 20:07:55 +0000] info [whostmgrd] 158.173.158.137 - root "GET /cpsess9203795385/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.158.137]


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 158.173.158.137
country_id: 3017382
description:
[2026-07-02 20:07:57 +0000] info [whostmgrd] 158.173.158.137 PURGE root:P73yAf3REy8QCFkF badpass [cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.158.137]]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - service.examens@ucao-uut.tg [07/02/2026:20:09:28 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: service.examens@ucao-uut.tg


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.155.27.244
country_id: 1819730
domain: lepoint-actu.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/index.php/wp-json/wp/v2/users/2||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.146.111.229
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2017/12/Rapport_Annuel_2016.pdf HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.251.122.165
country_id: 6252001
description:
Jul  2 20:14:48 ns5 pure-ftpd[3895306]: (?@47.251.122.165) [INFO] New connection from 47.251.122.165


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.95.59
country_id: 2378080
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/macite.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.62.230
country_id: 3932488
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/contact HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 165.140.119.146
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-16.165.140.119.146||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 20:17:55 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.155.72.28
country_id: 1668284
description:
Jul  2 20:18:59 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.155.72.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.155.72.28
country_id: 1668284
description:
2026-07-02 20:19:01 dovecot_plain authenticator failed for H=182-155-72-28.veetime.com (genness) [182.155.72.28]:8360: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.102.92
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/home HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.172.230
country_id: 6252001
domain: mail.zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.zephyr.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: viulacerdanya.cat
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/viulacerdanya.cat/wp-content/plugins/plugins/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vittasmexicanbarandgrill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vittasmexicanbarandgrill.com/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vitriersbelgique.be
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vitriersbelgique.be/cache/cache/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vittaeducacional.com.br
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vittaeducacional.com.br/images/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vitsa.co
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vitsa.co/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vitulli.eu
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vitulli.eu/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vittiimmobiliare.it
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vittiimmobiliare.it/assets/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 80.102.147.174
country_id: 2510769
domain: vitrinenews.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/images/images/images/images/images/images/cache.php||SC:/home/yydrdvav/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vitteriponce.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vitteriponce.com/blogs/media/media/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vituslawyers.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vituslawyers.com/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vitxblog.xyz
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vitxblog.xyz/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.102.147.174
country_id: 2510769
domain: vitrinerural.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vitrinerural.com/blogs/media/media/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.157
country_id: 1269750
description:
Jul  2 20:27:25 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.2
country_id: 99237
description:
Jul  2 20:27:05 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: wellcity.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; SM-G990U2 Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/en ByteFullLocale/en Region/JM AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.33.72.20
country_id: 6252001
description:
[2026-07-02 20:29:42 +0000] info [cpaneld] 100.33.72.20 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.113.185
country_id: 6252001
description:
[2026-07-02 20:29:59 +0000] info [cpaneld] 76.136.113.185 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.195.236.240
country_id: 6252001
description:
[2026-07-02 20:29:47 +0000] info [cpaneld] 75.195.236.240 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.99.237.184
country_id: 6252001
description:
[2026-07-02 20:29:51 +0000] info [cpaneld] 73.99.237.184 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.1.167.237
country_id: 6252001
description:
[2026-07-02 20:30:13 +0000] info [cpaneld] 198.1.167.237 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.215.103.72
country_id: 6252001
description:
[2026-07-02 20:30:05 +0000] info [cpaneld] 98.215.103.72 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.193.129.125
country_id: 6290252
description:
Jul  2 20:30:14 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.193.129.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 16.79.112.1
country_id: 1643084
domain: www.arse.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 20:30:33 +0000] info [cpaneld] 172.111.157.143 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.214.190.6
country_id: 6252001
description:
[2026-07-02 20:32:14 +0000] info [cpaneld] 73.214.190.6 - inger "GET /login/?login_only=1&user=inger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.113.25
country_id: 6252001
description:
[2026-07-02 20:32:18 +0000] info [cpaneld] 217.217.113.25 - ingertg "GET /login/?login_only=1&user=ingertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ingertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.203.228.53
country_id: 6252001
description:
[2026-07-02 20:32:22 +0000] info [cpaneld] 73.203.228.53 - inge "GET /login/?login_only=1&user=inge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inge (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.32.246.127
country_id: 6252001
description:
[2026-07-02 20:32:31 +0000] info [cpaneld] 73.32.246.127 - in "GET /login/?login_only=1&user=in&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user in (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.242.180
country_id: 3469034
domain: mail.plethosarl.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.plethosarl.free.netmaster.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.215.35
country_id: 2363686
description:
[2026-07-02 20:33:35 +0000] info [webmaild] 196.168.215.35 - wiyao.g@inger.tg "POST /cpsess1226495465/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.112.108] != Current IP Address [196.168.215.35]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 31.77.67.205
country_id: 2921044
domain: wages.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.23||T:APACHE||MV:/images/images/cache.php||SC:/home/aopsacai/public_html/images||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-07-02 20:38:16 +0000] info [cpaneld] 5.230.133.146 NEW formationfreenet:DsTDmKjo92UOT5cs address=5.230.133.146,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.212.32.195
country_id: 630336
domain: wahahalife.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wahahalife.com/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.212.32.195
country_id: 630336
domain: wahdahbombana.or.id
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wahdahbombana.or.id/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.77.67.205
country_id: 2921044
domain: wagfamilylaw.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wagfamilylaw.com/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.128.10.216
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/une-delegation-americaine-en-immersion-culturelle-au-togo/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.212.32.195
country_id: 630336
domain: wagyusan.com.mx
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wagyusan.com.mx/images/images/images/images/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.212.32.195
country_id: 630336
domain: wagyufactory.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wagyufactory.com/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.77.67.205
country_id: 2921044
domain: wagglbrasil.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/wagglbrasil.com/assets/images/images/cache.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.128.10.216
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/une-delegation-americaine-en-immersion-culturelle-au-togo/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-07-02 20:38:25 +0000] info [cpaneld] 5.230.133.44 NEW formationfreenet:j77VWmIO2FbaabEQ address=5.230.133.44,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.207.165.115
country_id: 357994
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/42.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.226.96.9
country_id: 3996063
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2021/02/EkTm_pRXcAABLWG.jpg 680w, http:/togomedia24.tg/wp-content/uploads/2021/02/EkTm_pRXcAABLWG-300x200.jpg 300w HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.165.160
country_id: 6252001
description:
[2026-07-02 20:40:40 +0000] info [cpaneld] 172.58.165.160 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.58.138.40
country_id: 6252001
description:
[2026-07-02 20:40:31 +0000] info [cpaneld] 71.58.138.40 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 20:40:59 +0000] info [cpaneld] 172.111.157.143 - 4968961470 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.141.4.38
country_id: 6252001
description:
[2026-07-02 20:40:35 +0000] info [cpaneld] 73.141.4.38 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.203.214.206
country_id: 6252001
description:
[2026-07-02 20:40:17 +0000] info [cpaneld] 75.203.214.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.218.46.29
country_id: 6252001
description:
[2026-07-02 20:40:25 +0000] info [cpaneld] 173.218.46.29 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.62.250.11
country_id: 6252001
description:
[2026-07-02 20:40:49 +0000] info [cpaneld] 173.62.250.11 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.145.245.75
country_id: 6252001
description:
[2026-07-02 20:40:21 +0000] info [cpaneld] 73.145.245.75 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.81.228.25
country_id: 6252001
description:
[2026-07-02 20:41:33 +0000] info [cpaneld] 38.81.228.25 - ucaou "GET /login/?login_only=1&user=ucaou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.75.208.84
country_id: 6252001
description:
[2026-07-02 20:41:41 +0000] info [cpaneld] 149.75.208.84 - uca "GET /login/?login_only=1&user=uca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.43.183.92
country_id: 3489940
description:
[2026-07-02 20:41:47 +0000] info [cpaneld] 96.43.183.92 - uc "GET /login/?login_only=1&user=uc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.56.107
country_id: 6252001
description:
[2026-07-02 20:41:29 +0000] info [cpaneld] 108.46.56.107 - ucaouu "GET /login/?login_only=1&user=ucaouu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.107.212.89
country_id: 6252001
description:
[2026-07-02 20:41:21 +0000] info [cpaneld] 209.107.212.89 - ucaouut "GET /login/?login_only=1&user=ucaouut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.197.75.6
country_id: 6252001
description:
[2026-07-02 20:41:25 +0000] info [cpaneld] 68.197.75.6 - ucaouuttg "GET /login/?login_only=1&user=ucaouuttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouuttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.154.161.97
country_id: 6252001
description:
[2026-07-02 20:41:37 +0000] info [cpaneld] 73.154.161.97 - ucao "GET /login/?login_only=1&user=ucao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucao (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.107.106
country_id: 3865483
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.15.236.144
country_id: 6252001
description:
[2026-07-02 20:42:46 +0000] info [cpaneld] 38.15.236.144 - sotranetogo "GET /login/?login_only=1&user=sotranetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.17.23.228
country_id: 6252001
description:
[2026-07-02 20:42:41 +0000] info [cpaneld] 76.17.23.228 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.206.149.240
country_id: 6252001
description:
[2026-07-02 20:42:56 +0000] info [cpaneld] 68.206.149.240 - sotranet "GET /login/?login_only=1&user=sotranet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.27.66
country_id: 6252001
description:
[2026-07-02 20:43:19 +0000] info [cpaneld] 73.120.27.66 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.131.32.36
country_id: 2921044
domain: afriquerevelation.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users/2||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.82.91.141
country_id: 1819730
description:
Jul  2 20:43:28 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.82.91.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.129.156
country_id: 6252001
description:
[2026-07-02 20:43:15 +0000] info [cpaneld] 172.58.129.156 - sot "GET /login/?login_only=1&user=sot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.183.252.18
country_id: 6252001
description:
[2026-07-02 20:43:08 +0000] info [cpaneld] 67.183.252.18 - sotra "GET /login/?login_only=1&user=sotra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.139.97.12
country_id: 6252001
description:
[2026-07-02 20:43:12 +0000] info [cpaneld] 69.139.97.12 - sotr "GET /login/?login_only=1&user=sotr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.91.141
country_id: 1819730
description:
2026-07-02 20:43:30 dovecot_plain authenticator failed for H=(cxk8g1tvjbc15rwsk6) [47.82.91.141]:56323: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.224.92.82
country_id: 2635167
domain: office.cameg-togo.tg
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:392258||Sizes:18211||Combined size:18211||User:camaegdtomgo||WPU:||Filename:BDKR28_rsjknf.zip||Scanned:/tmp//20260702-204350-akbNhemMX5sJ4QwtsAcNDQAAAAk-file-cyn2VJ||SC:/home/camaegdtomgo/public_html/office/index.php||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.23.147
country_id: 6252001
description:
[2026-07-02 20:43:05 +0000] info [cpaneld] 143.105.23.147 - sotran "GET /login/?login_only=1&user=sotran&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotran (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.2
country_id: 3469034
description:
Jul  2 20:44:07 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.164.27
country_id: 2363686
description:
102.64.164.27 - - [02/Jul/2026:20:46:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802948&pdata=https%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783025199 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.164.27


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.219.65.105
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/tofa-2026-ouidah-entre-tradition-et-spiritualite/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.219.65.105
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tofa-2026-ouidah-entre-tradition-et-spiritualite/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.187.207.34
country_id: 6252001
description:
[2026-07-02 20:48:54 +0000] info [cpaneld] 68.187.207.34 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.251.51.183
country_id: 6252001
description:
[2026-07-02 20:49:00 +0000] info [cpaneld] 69.251.51.183 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.229.122
country_id: 248816
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/zlecaf-le-cnp-togo-presente-les-opportunites-aux-femmes/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.229.122
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/zlecaf-le-cnp-togo-presente-les-opportunites-aux-femmes/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.66.113.234
country_id: 6252001
description:
[2026-07-02 20:49:05 +0000] info [cpaneld] 153.66.113.234 - cafetg "GET /login/?login_only=1&user=cafetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.121.83
country_id: 6252001
description:
[2026-07-02 20:49:16 +0000] info [cpaneld] 76.39.121.83 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.183
country_id: 2300660
description:
Jul  2 20:49:43 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.172.247.23
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/adzinikuzan-2023-apotheose HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.79
country_id: 2635167
description:
[2026-07-02 20:52:45 +0000] info [cpaneld] 5.230.133.79 - rdlizssu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.99.226
country_id: 3469034
description:
Jul  2 20:56:43 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.99.226 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.150.177.189
country_id: 2921044
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:45.150.177.189||TA:45.150.177.189||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 20:59:25 +0000] info [cpaneld] 172.111.157.143 - 8388163051 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.151
country_id: 1880251
description:
43.172.195.151 - - [02/Jul/2026:21:01:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015706&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14416&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783026080 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.151


plugin: modsec
rule: 77350257
name: IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2
abuser: 102.64.165.108
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Subscriber and Arbitrary Shortcode Execution in WordPress < 6.3.2||MVN:ARGS:shortcode||MV:[embed]https://youtu.be/gVWedj6-iUY[/embed]||WPU:direct7tv||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 21:02:41 +0000] info [cpaneld] 172.111.157.143 - 7383794592 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.135.117.99
country_id: 1814991
description:
[2026-07-02 21:02:57 +0000] info [cpaneld] 124.135.117.99 - iyfttuec "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-07-02 21:04:01 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:60058: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.217.88
country_id: 2363686
description:
102.64.217.88 - - [02/Jul/2026:21:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988706&pdata=https%253A%252F%252Fshekina.tensai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783026511 HTTP/2.0" 302 0 shekina.tensai.tg "https://shekina.tensai.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.217.88


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 31.134.7.72
country_id: 241170
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:kacpenelope||Email:penelope.penelope87@gemoyo.greenweed.sbs||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 31.134.7.72
country_id: 241170
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.23||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.166.37
country_id: 2363686
description:
102.64.166.37 - - [02/Jul/2026:21:12:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157738&pdata=https%253A%252F%252Ftdn.tg%252Finondations-dans-le-grand-lome-des-deces-enregistres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783026733 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inondations-dans-le-grand-lome-des-deces-enregistres/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.166.37


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-07-02 21:15:20 +0000] info [cpaneld] 5.230.153.154 NEW gsizyncj:L3BNLtlpLUgu3_dJ address=5.230.153.154,app=cpaneld,creator=gsizyncj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 21:15:54 +0000] info [cpaneld] 172.111.157.143 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.131
country_id: 1880251
description:
43.172.197.131 - - [02/Jul/2026:21:19:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805260&pdata=http%253A%252F%252Fcafe.tg%252Fpage%252F2%252F%253Fs%253Dcybers%2525C3%2525A9curit%2525C3%2525A9&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783027164 HTTP/1.1" 404 561 cafe.tg "http://cafe.tg/page/2/?s=cybers%C3%A9curit%C3%A9" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.115.11.129
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.115.11.129
country_id: 2328926
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/route-nationale-n1-un-accident-fait-dix-morts/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.57.208.83
country_id: 3865483
domain: www.educplusmedia.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.educplusmedia.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.57.208.83
country_id: 3865483
domain: www.educplusmedia.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.educplusmedia.tghttp/www.educplusmedia.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.160.134
country_id: 2363686
description:
[2026-07-02 21:25:48 +0000] info [webmaild] 102.64.160.134 - direction@togointerim.net "POST /cpsess7122940689/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.46.177] != Current IP Address [102.64.160.134]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.60.108.253
country_id: 6252001
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.177.155
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/produit/c5/?add-to-cart=7893||QS:add-to-cart=7893||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.44.149
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/3 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.50
country_id: 3469034
description:
Jul  2 21:35:18 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.71.135.246
country_id: 2542007
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.24.86
country_id: 3469034
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.79.66
country_id: 3686110
description:
Jul  2 21:37:07 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.79.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.123
country_id: 3175395
description:
Jul  2 21:37:24 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.197.200.182
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-en-fete-togo-2000 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 21:38:15 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.128.92
country_id: 163843
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/48.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.206.52.33
country_id: 3625428
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=149 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.231.123.59
country_id: 2921044
description:
Jul  2 21:43:07 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.231.123.59 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.111.37.188
country_id: 3996063
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:109.111.37.188||TA:109.111.37.188||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 21:45:44 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:39424: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.233.56.109
country_id: 2661886
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=149 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.39
country_id: 690791
description:
Jul  2 21:46:15 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.228.206.233
country_id: 2963597
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/citemag/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.228.206.233
country_id: 2963597
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/citemag/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.118.33.100
country_id: 2542007
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/djama-pilsner HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.174.104.74
country_id: 2017370
description:
2026-07-02 21:47:12 dovecot_login authenticator failed for H=([125.138.166.217]) [109.174.104.74]:53028: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.174.104.74
country_id: 2017370
description:
Jul  2 21:47:10 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.174.104.74 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 15.235.117.109
country_id: 6251999
domain: derou.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:15.235.117.109||TA:15.235.117.109||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.174.104.74
country_id: 2017370
description:
Jul  2 21:51:06 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.174.104.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.174.104.74
country_id: 2017370
description:
2026-07-02 21:51:08 dovecot_login authenticator failed for H=([125.138.166.217]) [109.174.104.74]:53078: 535 Incorrect authentication data (set_id=katakpamey@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-02 21:51:40 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([192.111.130.1]) [94.61.159.91]:46470: 535 Incorrect authentication data (set_id=katakpamey)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.120.226
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:172.120.120.226||TA:172.120.120.226||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.75.230.199
country_id: 2802361
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:103.75.230.199||TA:103.75.230.199||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.53.219.248
country_id: 2077456
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:103.53.219.248||TA:103.53.219.248||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.202.220
country_id: 798544
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:46.203.202.220||TA:46.203.202.220||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.121.102
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:198.37.121.102||TA:198.37.121.102||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.161.119
country_id: 2510769
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:109.196.161.119||TA:109.196.161.119||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.194.238
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:89.249.194.238||TA:89.249.194.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.222.187.170
country_id: 2750405
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.222.187.170||TA:104.222.187.170||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.215.28
country_id: 2077456
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:161.123.215.28||TA:161.123.215.28||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.114.59.213
country_id: 1269750
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:103.114.59.213||TA:103.114.59.213||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.218.207
country_id: 3469034
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:108.165.218.207||TA:108.165.218.207||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.144.58
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:148.135.144.58||TA:148.135.144.58||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.46.116
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:145.223.46.116||TA:145.223.46.116||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.212.219
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:213.169.212.219||TA:213.169.212.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.11.235
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:191.101.11.235||TA:191.101.11.235||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.112.36
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:172.120.112.36||TA:172.120.112.36||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 64.137.100.220
country_id: 2661886
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:64.137.100.220||TA:64.137.100.220||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.121.244
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:152.232.121.244||TA:152.232.121.244||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.149.245
country_id: 1880251
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.252.149.245||TA:104.252.149.245||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.129.253.109
country_id: 3469034
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:23.129.253.109||TA:23.129.253.109||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.142.208
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:107.181.142.208||TA:107.181.142.208||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [02/Jul/2026:21:55:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143848&pdata=https%253A%252F%252Fyanacom.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783029321 HTTP/2.0" 302 0 yanacom.tg "https://yanacom.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.131.102.102
country_id: 458258
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:45.131.102.102||TA:45.131.102.102||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.40.201
country_id: 6251999
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.239.40.201||TA:104.239.40.201||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.205.252
country_id: 1605651
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:62.105.205.252||TA:62.105.205.252||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-07-02 21:56:50 +0000] info [cpaneld] 5.230.153.52 - fnnjmavs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.53.214
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:162.252.53.214||TA:162.252.53.214||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.74.182
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/67.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.60.46.68
country_id: 2661886
description:
[2026-07-02 21:57:25 +0000] info [cpaneld] 13.60.46.68 - ingertgsarl "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [02/Jul/2026:21:58:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592879&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783029525 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [02/Jul/2026:21:58:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182486&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783029528 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.148
country_id: 732800
description:
Jul  2 22:00:43 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.14
country_id: 2510769
description:
Jul  2 22:01:01 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-02 22:01:37 dovecot_login authenticator failed for H=([218.94.115.164]) [210.5.117.238]:58323: 535 Incorrect authentication data (set_id=master)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.5.117.238
country_id: 1694008
description:
Jul  2 22:01:35 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.5.117.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.8.97
country_id: 1835841
description:
Jul  2 22:01:12 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.8.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.14
country_id: 2510769
description:
Jul  2 22:01:08 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-02 22:01:14 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [218.156.8.97]:43084: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.214
country_id: 3469034
description:
Jul  2 22:02:09 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.154
country_id: 953987
description:
Jul  2 22:02:31 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.233.223
country_id: 6252001
domain: api.devtech.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/api.devtech.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.18.127.107
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:212.18.127.107||TA:212.18.127.107||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [02/Jul/2026:22:06:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801762&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783030010 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:07:30 dovecot_login authenticator failed for H=(Zy0dXKEkf) [92.118.39.148]:50369: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.93.117.197
country_id: 690791
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/jeu-concours-capsule-2023 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-02 22:08:52 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 92.118.39.148 (United States:US)”


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 92.118.39.148
country_id: 798549
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Remote IP Address]=[92.118.39.148] [Authentication Database]=[mail] [Username]=[contact@letempsdaider.org] (5/5 failures) (blocked until [Thu Jul  2 22:23:38 2026 UTC/Thu Jul  2 22:23:38 2026 LOCAL])


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.26.192
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:08:04 dovecot_login authenticator failed for H=(h7eitA) [92.118.39.148]:55732: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.204.218
country_id: 1605651
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:62.105.204.218||TA:62.105.204.218||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.26.192
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/lutte-contre-le-terrorisme-faure-gnassingbe-felicite-et-encourage-les-fat-en-poste/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.143.161.110
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-16-at-21.19.26.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:09:08 dovecot_login authenticator failed for H=(kmOZWwnL) [92.118.39.148]:50067: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:10:20 dovecot_login authenticator failed for H=(nXStJL) [92.118.39.148]:60894: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.240.123
country_id: 2542007
description:
Jul  2 22:11:38 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.240.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.48.229.117
country_id: 3469034
description:
Jul  2 22:11:55 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.48.229.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:11:30 dovecot_login authenticator failed for H=(wBQAbMy8u4) [92.118.39.148]:55477: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-02 22:11:40 dovecot_login authenticator failed for H=([104.157.40.219]) [154.146.240.123]:50324: 535 Incorrect authentication data (set_id=katakpamey@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-07-02 22:11:57 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (cpc1-ersk4-2-0-cust471.know.cable.virginm.net) [179.48.229.117]:50442: 535 Incorrect authentication data (set_id=katakpamey)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:11:11 dovecot_login authenticator failed for H=(dGeoNc) [92.118.39.148]:52440: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:12:04 dovecot_login authenticator failed for H=(x7XonM5) [92.118.39.148]:60299: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.178
country_id: 3865483
description:
Jul  2 22:12:29 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:13:11 dovecot_login authenticator failed for H=(VuCX44u) [92.118.39.148]:53853: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:14:15 dovecot_login authenticator failed for H=(MDX0yHgOF) [92.118.39.148]:63864: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.214.108.67
country_id: 6252001
description:
Jul  2 22:14:47 ns5 auth[3457859]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.214.108.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-02 22:15:47 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 92.118.39.148 (United States:US)”


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:15:09 dovecot_login authenticator failed for H=(YOPfEO3) [92.118.39.148]:56080: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 92.118.39.148
country_id: 798549
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Remote IP Address]=[92.118.39.148] [Authentication Database]=[mail] [Username]=[contact@letempsdaider.org] (30/30 failures) (blocked until [Fri Jul  3 22:15:41 2026 UTC/Fri Jul  3 22:15:41 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:15:26 dovecot_login authenticator failed for H=(bf37zW) [92.118.39.148]:58668: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:16:17 dovecot_login authenticator failed for H=(zPt0Ok) [92.118.39.148]:50714: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.224.222.127
country_id: 3996063
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/12.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 142.111.22.8
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:17:13 dovecot_login authenticator failed for H=(cmnn8pG0) [92.118.39.148]:60025: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:18:22 dovecot_login authenticator failed for H=(6EhR1M) [92.118.39.148]:55080: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:19:14 dovecot_login authenticator failed for H=(3xNl8aUnl) [92.118.39.148]:63767: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:19:32 dovecot_login authenticator failed for H=(7t2Trk) [92.118.39.148]:50313: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:20:06 dovecot_login authenticator failed for H=(idWHNAVhz) [92.118.39.148]:56481: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:21:15 dovecot_login authenticator failed for H=(qmmLniXNe) [92.118.39.148]:51858: 535 Incorrect authentication data (set_id=contact@letempsdaider.org)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.49.130.1
country_id: 3686110
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/8 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:22:11 dovecot_login authenticator failed for H=(AaZTLQ0) [92.118.39.148]:61295: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:23:04 dovecot_login authenticator failed for H=(P2qnjo) [92.118.39.148]:53772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:23:21 dovecot_login authenticator failed for H=(enss4Oz) [92.118.39.148]:56698: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.61
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/produit/escapins/?add-to-cart=9591||QS:add-to-cart=9591||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:24:12 dovecot_login authenticator failed for H=(bbtDBFh) [92.118.39.148]:65168: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:25:20 dovecot_login authenticator failed for H=(K9N7i7oS) [92.118.39.148]:59613: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.24.224
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:26:12 dovecot_login authenticator failed for H=(sWIJhqHb) [92.118.39.148]:51665: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.168.193.16
country_id: 3017382
description:
88.168.193.16 - - [02/Jul/2026:22:26:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739931&pdata=https%253A%252F%252Fcpanel.oliane.free.netmaster.tg%252F%253Flocale%253Del&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783031187 HTTP/2.0" 302 0 cpanel.oliane.free.netmaster.tg "https://cpanel.oliane.free.netmaster.tg/?locale=el" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.168.193.16


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:27:03 dovecot_login authenticator failed for H=(a5tfxfyi) [92.118.39.148]:61085: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.148
country_id: 798549
description:
2026-07-02 22:27:14 dovecot_login authenticator failed for H=(8uXKc2) [92.118.39.148]:63576: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.76.130.172
country_id: 3190538
description:
176.76.130.172 - - [02/Jul/2026:22:31:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185578&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783031463 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.76.130.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.154.134.180
country_id: 1814991
description:
2026-07-02 22:31:44 dovecot_login authenticator failed for H=([123.118.230.64]) [220.154.134.180]:56326: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 22:32:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20390: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 22:32:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64290: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.143
country_id: 1643084
description:
[2026-07-02 22:31:43 +0000] info [cpaneld] 172.111.157.143 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.250.151.47
country_id: 3932488
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/19.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 22:32:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30978: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.18.127.215
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:212.18.127.215||TA:212.18.127.215||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 22:34:07 dovecot_login authenticator failed for H=(services.dgdn.gouv.tg) [161.35.78.120]:55720: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 140.204.4.34
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 140.204.4.34: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 140.204.4.33
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 140.204.4.33: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.182.19
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/boissons-2/?add-to-cart=9824||QS:add-to-cart=9824||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2026-07-02 22:35:18 dovecot_login authenticator failed for H=([70.166.167.59]) [187.50.194.182]:32803: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 22:35:53 dovecot_login authenticator failed for H=(services.dgdn.gouv.tg) [161.35.78.120]:46560: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.7.2
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/trois-ans-de-succes-pour-togomall-le-supermarche-100-local/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-02 22:37:04 +0000] info [cpaneld] 152.69.171.23 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.7.2
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/trois-ans-de-succes-pour-togomall-le-supermarche-100-local/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.152.12.212
country_id: 1210997
description:
2026-07-02 22:38:15 dovecot_login authenticator failed for H=([183.171.61.130]) [59.152.12.212]:54838: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.222.202
country_id: 2363686
description:
[2026-07-02 22:37:53 +0000] info [cpaneld] 102.64.222.202 NEW vejjghdd:_OU9rNCzDFtWep1i address=102.64.222.202,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 22:38:56 dovecot_login authenticator failed for H=(services.dgdn.gouv.tg) [161.35.78.120]:60268: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 22:39:40 dovecot_plain authenticator failed for H=([127.0.0.1]) [161.35.78.120]:37384: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 22:40:24 dovecot_login authenticator failed for H=([127.0.0.1]) [161.35.78.120]:56368: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.169.17
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:140.235.169.17||TA:140.235.169.17||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  2 22:41:16 ns5 dovecot[3966712]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 22:40:46 dovecot_login authenticator failed for H=([127.0.0.1]) [161.35.78.120]:43438: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 161.35.78.120
country_id: 2921044
description:
2026-07-02 22:40:46 dovecot_plain authenticator failed for H=([127.0.0.1]) [161.35.78.120]:43438: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.57.207.101
country_id: 3686110
description:
176.57.207.101 - - [02/Jul/2026:22:43:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974062&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-226849netidm18zen.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783032190 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-226849netidm18zen.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.57.207.101


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 202.152.254.69
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 202.152.254.69: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.131.111.9
country_id: 290291
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/agriculture-au-togo-le-promai-franchit-une-etape-cle/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.131.111.9
country_id: 290291
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/agriculture-au-togo-le-promai-franchit-une-etape-cle/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.23.130
country_id: 2017370
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-47.46.8.23.130||RSV:8.23||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 43.157.251.185
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 43.157.251.185: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-07-02 22:50:18 dovecot_plain authenticator failed for H=(gententous) [41.248.243.181]:45888: 535 Incorrect authentication data (set_id=admin@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.122.84
country_id: 99237
description:
2026-07-02 22:52:10 dovecot_plain authenticator failed for H=([69.172.210.47]) [212.237.122.84]:8203: 535 Incorrect authentication data (set_id=admin@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.50.210
country_id: 2017370
description:
2026-07-02 22:51:53 dovecot_plain authenticator failed for H=([69.172.210.47]) [151.0.50.210]:59886: 535 Incorrect authentication data (set_id=info@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.94.39.227
country_id: 3469034
description:
2026-07-02 22:52:29 dovecot_plain authenticator failed for H=([69.172.210.47]) [138.94.39.227]:64181: 535 Incorrect authentication data (set_id=support@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.135.62.40
country_id: 2017370
description:
2026-07-02 22:52:46 dovecot_plain authenticator failed for H=([69.172.210.47]) [88.135.62.40]:39770: 535 Incorrect authentication data (set_id=marketing@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.12.188.184
country_id: 3865483
description:
2026-07-02 22:53:23 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.12.188.184]:22673: 535 Incorrect authentication data (set_id=contato@inger.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 50.18.18.81
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 50.18.18.81: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.245.52.230
country_id: 3865483
description:
2026-07-02 22:53:04 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.245.52.230]:54840: 535 Incorrect authentication data (set_id=contact@inger.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 13.56.220.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 13.56.220.74: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.175.245.127
country_id: 1210997
description:
2026-07-02 22:53:42 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.175.245.127]:42746: 535 Incorrect authentication data (set_id=contacto@inger.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.243.188
country_id: 3017382
domain: ucao-uut.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.28.243.188||TA:104.28.243.188||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.135.12.49
country_id: 953987
description:
2026-07-02 22:54:01 dovecot_plain authenticator failed for H=([69.172.210.47]) [41.135.12.49]:51524: 535 Incorrect authentication data (set_id=financeiro@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.26.30
country_id: 3469034
description:
2026-07-02 22:54:19 dovecot_plain authenticator failed for H=45-181-26-30.infonet-isp.com.br ([69.172.210.47]) [45.181.26.30]:41346: 535 Incorrect authentication data (set_id=comercial@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.131.170.14
country_id: 3865483
description:
2026-07-02 22:54:38 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.131.170.14]:37550: 535 Incorrect authentication data (set_id=it@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.175.245.127
country_id: 1210997
description:
2026-07-02 22:53:50 dovecot_login authenticator failed for H=([69.172.210.47]) [103.175.245.127]:42746: 535 Incorrect authentication data (set_id=contacto@inger.tg)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 104.28.243.188
country_id: 3017382
domain: ucao-uut.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.131.170.14
country_id: 3865483
description:
2026-07-02 22:54:46 dovecot_login authenticator failed for H=([69.172.210.47]) [186.131.170.14]:37550: 535 Incorrect authentication data (set_id=it@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.137.72.226
country_id: 294640
description:
2026-07-02 22:54:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [77.137.72.226]:18580: 535 Incorrect authentication data (set_id=accounts@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.5.84.149
country_id: 3469034
description:
2026-07-02 22:55:11 dovecot_plain authenticator failed for H=ip-191-5-84-149.isp.valenet.com.br ([69.172.210.47]) [191.5.84.149]:56530: 535 Incorrect authentication data (set_id=suporte@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.167.49.176
country_id: 3508796
description:
2026-07-02 22:55:28 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.167.49.176]:59245: 535 Incorrect authentication data (set_id=hr@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.235.111.6
country_id: 1668284
description:
2026-07-02 22:55:40 dovecot_plain authenticator failed for H=(mp22quf0mlhxig05t5rrw4o85awv4) [66.235.111.6]:46987: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.230.144.74
country_id: 2464461
description:
2026-07-02 22:55:43 dovecot_plain authenticator failed for H=([69.172.210.47]) [41.230.144.74]:38516: 535 Incorrect authentication data (set_id=office@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.8.134.106
country_id: 272103
description:
2026-07-02 22:56:38 dovecot_plain authenticator failed for H=([69.172.210.47]) [5.8.134.106]:48396: 535 Incorrect authentication data (set_id=clients@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.66.118.45
country_id: 3469034
description:
2026-07-02 22:56:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [200.66.118.45]:5870: 535 Incorrect authentication data (set_id=soporte@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.230.144.74
country_id: 2464461
description:
2026-07-02 22:55:50 dovecot_login authenticator failed for H=([69.172.210.47]) [41.230.144.74]:38516: 535 Incorrect authentication data (set_id=office@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.171.234.101
country_id: 1562822
description:
2026-07-02 22:56:21 dovecot_plain authenticator failed for H=([69.172.210.47]) [14.171.234.101]:47554: 535 Incorrect authentication data (set_id=ventas@inger.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.118
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/telephones-2/tecno/tecno-pouvoir-2/?add-to-cart=2358||QS:add-to-cart=2358||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.8.134.106
country_id: 272103
description:
2026-07-02 22:56:45 dovecot_login authenticator failed for H=([69.172.210.47]) [5.8.134.106]:48396: 535 Incorrect authentication data (set_id=clients@inger.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.116.140
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/71.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.32.248.240
country_id: 2921044
description:
193.32.248.240 - - [02/Jul/2026:22:57:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10447766&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftag%252Fbanque-africaine-de-developpement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783033058 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/tag/banque-africaine-de-developpement/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.32.248.240


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jul 02 22:58:41 ns5.netmaster.tg cpanel_fileman_hook[3973387]: 0 BAILOUT malware detected when upload 'ycccplrr.php' in /home/wcnyaruu/public_html for user wcnyaruu


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.187.205.49
country_id: 99237
description:
[2026-07-02 22:58:36 +0000] info [cpaneld] 185.187.205.49 NEW wcnyaruu:C_4aQgA1TuNBVg_6 address=185.187.205.49,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.236.239.60
country_id: 6252001
description:
[2026-07-02 22:59:12 +0000] info [cpaneld] 172.236.239.60 NEW wcnyaruu:3dxTTTgJvoB7TfyA address=172.236.239.60,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.173.123.247
country_id: 3017382
description:
2026-07-02 22:59:31 dovecot_plain authenticator failed for H=vmi3192681.contaboserver.net (c9f6zz8lpai92gzajx) [157.173.123.247]:52756: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-07-02 22:59:39 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (plaiketic) [24.61.199.212]:35582: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.188
country_id: 3017382
domain: ucoangers.tg
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.php.bak||User:eevbufog||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.79.150.207
country_id: 6252001
description:
[2026-07-02 23:01:37 +0000] info [cpaneld] 45.79.150.207 NEW wcnyaruu:gV9CtJ4ZoZA1fTG5 address=45.79.150.207,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.182.195.135
country_id: 6252001
domain: flp-tg.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.23||T:APACHE||REQUEST_URI:/site/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 178.175.35.94
country_id: 831053
description:
178.175.35.94 - - [02/Jul/2026:23:03:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000025&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoeux-a-la-nation-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783033413 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voeux-a-la-nation-2020/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.5228.1003 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:178.175.35.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.180.86
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-lieutenant-colonel-atafai-tchangani-prend-le-commandement-du-corps-des-agents-des-eaux-et-forets/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.180.86
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-lieutenant-colonel-atafai-tchangani-prend-le-commandement-du-corps-des-agents-des-eaux-et-forets/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.126.152
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/developpement-a-la-base-16-342-auto-emplois-crees-entre-2024-et-2025/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.126.152
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/developpement-a-la-base-16-342-auto-emplois-crees-entre-2024-et-2025/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.76.130.172
country_id: 3190538
description:
176.76.130.172 - - [02/Jul/2026:23:07:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117254&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783033624 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.76.130.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-02 23:07:44 +0000] info [cpaneld] 152.69.171.23 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.162.57
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175qkakhm/fonts/52339aa967ec.phtm||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.162.48
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175qycfoc/fonts/52339aa967ec.phps||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.159.20
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175ismvoz/fonts/52339aa967ec.php.PhP||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.164.227
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175gqacrl/fonts/52339aa967ec.pht||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.163.92
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175imncfe/fonts/52339aa967ec.php8||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.164.72
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175hwxbso/fonts/52339aa967ec.php||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.159.11
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175ywvtli/fonts/52339aa967ec.PhP||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.162.111
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175ucjqpz/fonts/52339aa967ec.php7||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.162.104
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175myfnnj/fonts/52339aa967ec.php4||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.159.8
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175yptphc/fonts/52339aa967ec.phar||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.28.162.113
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175umrpcu/fonts/52339aa967ec.phtml||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 207.154.227.25
country_id: 2921044
domain: pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/52339aa967ec175nemjjc/fonts/52339aa967ec.shtml||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.16.120
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-13.37.63.16.120||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-02 23:13:38 +0000] info [cpaneld] 152.69.171.23 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.192.176.103
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.192.176.103: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-07-02 23:16:06 +0000] info [cpaneld] 51.83.5.75 NEW wcnyaruu:3eAPBKdV_3qFsZcg address=51.83.5.75,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.70.234.216
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:194.70.234.216||TA:194.70.234.216||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.151
country_id: 690791
description:
2026-07-02 23:16:57 dovecot_plain authenticator failed for H=([77.83.39.151]) [77.83.39.151]:49161: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 77.83.39.151
country_id: 690791
description:
Jul  2 23:17:06 ns5 pure-ftpd[3981149]: (?@77.83.39.151) [WARNING] Authentication failed for user [contact]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.239.155.79
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.239.155.79: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.142.45
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/5 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.78.102
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/journee-internationale-des-travailleurs HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.77.134.14
country_id: 3617476
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/mission HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.168.131.228
country_id: 2363686
domain: www.letabloid.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.32.248.185
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 193.32.248.185: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.69.116.173
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/warsteiner HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.134
country_id: 6252001
description:
[2026-07-02 23:36:29 +0000] info [cpaneld] 107.174.169.134 NEW oviaiart:Qolcs6j5yicgqOlv address=107.174.169.134,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.166.127
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/wp-login.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.76.130.172
country_id: 3190538
description:
176.76.130.172 - - [02/Jul/2026:23:42:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6987372&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783035761 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.76.130.172


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.209.220.42
country_id: 2287781
description:
102.209.220.42 - - [02/Jul/2026:23:44:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778014&pdata=https%253A%252F%252Fwww.snb.tg%252Ffr%252Fold%252Fevent%252Flancement-bitter-lemon-by-chap&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783035848 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/fr/old/event/lancement-bitter-lemon-by-chap" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.7309.1489 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.209.220.42


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.174.154
country_id: 6252001
domain: admin.otf-boutique.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/admin.otf-boutique.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 20.94.216.157
country_id: 6252001
domain: clinique-ccl.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.35.168.61
country_id: 2635167
description:
2026-07-02 23:48:42 dovecot_login authenticator failed for H=176-35-168-61.xdsl.murphx.net (94.154.35.215) [176.35.168.61]:36316: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 46.62.143.204
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 46.62.143.204: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-07-02 23:53:58 +0000] info [cpaneld] 5.230.153.52 NEW ecukpqcm:XgRcjQa15hhoPEsG address=5.230.153.52,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-03 00:05:04 +0000] info [cpaneld] 152.69.171.23 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.112.182.202
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/gbagba-2023-apotheose HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.104.85.245
country_id: 1694008
description:
124.104.85.245 - - [03/Jul/2026:00:08:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198421&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-277009tetidm77fet.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783037289 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-277009tetidm77fet.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.104.85.245


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.86
country_id: 6252001
description:
[2026-07-03 00:11:18 +0000] info [cpaneld] 134.195.83.86 - zgqykfsi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.144.0.230
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.144.0.230: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.13.7.181
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.13.7.181: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.76.149
country_id: 6252001
domain: www.cafe.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:216.173.76.149||TA:216.173.76.149||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.143.82.91
country_id: 2542007
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/tag/cedeao/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.163.12
country_id: 3686110
domain: www.afriquerevelation.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.afriquerevelation.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.163.12
country_id: 3686110
domain: www.afriquerevelation.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.afriquerevelation.tghttp/www.afriquerevelation.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.172.13
country_id: 192950
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/warsteiner HTTP/1.1||RSV:8.23||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 209.99.188.121
country_id: 2658434
description:
Denial of Service (DoS) attack was discovered from 209.99.188.121: 80 connections per 30 seconds to 2083 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:00:27:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183834&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783038459 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.38.4.69
country_id: 2921044
description:
[2026-07-03 00:27:52 +0000] info [cpaneld] 82.38.4.69 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.190.187
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/history HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.38.4.69
country_id: 2921044
description:
[2026-07-03 00:29:32 +0000] info [cpaneld] 82.38.4.69 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.38.4.69
country_id: 2921044
description:
[2026-07-03 00:30:16 +0000] info [cpaneld] 82.38.4.69 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-07-03 00:30:19 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=champion@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-07-03 00:29:56 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:39642: 535 Incorrect authentication data (set_id=champion@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.225.206
country_id: 1814991
description:
2026-07-03 00:29:57 dovecot_login authenticator failed for H=([222.75.225.206]) [222.75.225.206]:36695: 535 Incorrect authentication data (set_id=champion@soena.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.115.173
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:45.133.115.173||TA:45.133.115.173||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-07-03 00:32:45 +0000] info [cpaneld] 134.195.82.52 - camaegdtomgo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.129.103.9
country_id: 3923057
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/djama-lager HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 43.196.4.229
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.147.233
country_id: 1880251
domain: misstogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/home-09-gym/www.anasaptogo.com||User:tgmisefred||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.27.98.72
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-togo-ne-veut-pas-dun-systeme-educatif-depourvu-dinfrastructures/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.78
country_id: 6252001
description:
[2026-07-03 00:42:19 +0000] info [cpaneld] 107.174.169.78 NEW oviaiart:jVC9JmnN20Qy7KN0 address=107.174.169.78,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.27.98.72
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-togo-ne-veut-pas-dun-systeme-educatif-depourvu-dinfrastructures/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.217
country_id: 3017382
description:
[2026-07-03 00:48:09 +0000] info [cpaneld] 5.231.255.217 NEW oviaiart:jgV04Q4dt3f0imXp address=5.231.255.217,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.60.247.193
country_id: 2661886
domain: www.enora.sodigaz.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/dvE3A5dmFlUov-63Ro9JMuDACOPb6O06zo41J4AuHoQ||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.232.2.56
country_id: 6252001
description:
198.232.2.56 - - [03/Jul/2026:00:50:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871780&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F01%252F27%252Fkara-le-centre-des-maladies-infectieuses-cmi-operationnel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783039846 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/01/27/kara-le-centre-des-maladies-infectieuses-cmi-operationnel/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.232.2.56


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.60.247.193
country_id: 2661886
domain: www.sodi.sodigaz.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/EHd4qBXSkyNqbPAs25KMxQJWpJReikYTbADB44q198I||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 3.129.22.132
country_id: 6252001
domain: sodi.sodigaz.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/pT293jxNPrwlEryxg9gpuG7eMmZgKlOfq1_e4Jgdu8w||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.54.12
country_id: 3608932
description:
2026-07-03 00:51:54 dovecot_login authenticator failed for H=(KXKZcjE) [131.161.54.12]:34331: 535 Incorrect authentication data (set_id=kkuassi@atms.tg)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 35.87.48.103
country_id: 6252001
domain: refonte.sodigaz.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/qqQTpJK4Pi24M62oAaC52BMbM6tQTsZ6XjX0OEBlNjk||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.99.75.224
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/la-snb-souffle-sa-premiere-bougie HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 167.100.105.244
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:167.100.105.244||TA:167.100.105.244||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.197.224
country_id: 1562822
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/home HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.81.173
country_id: 2260494
domain: zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/zephyr.tg/zephy.tg/js/?C=D;O=A HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [03/Jul/2026:00:55:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143850&pdata=http%253A%252F%252Fwww.enora.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783040147 HTTP/1.1" 302 0 www.enora.sodigaz.tg "http://www.enora.sodigaz.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:00:55:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661077&pdata=https%253A%252F%252Fwww.refonte.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783040156 HTTP/2.0" 302 0 www.refonte.sodigaz.tg "https://www.refonte.sodigaz.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:00:55:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7498607&pdata=http%253A%252F%252Fwww.api.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783040147 HTTP/1.1" 302 0 www.api.sodigaz.tg "http://www.api.sodigaz.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 200.25.70.196
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 200.25.70.196: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.173.155.240
country_id: 2921044
description:
Jul  3 00:57:14 ns5 pure-ftpd[4027793]: (?@158.173.155.240) [INFO] New connection from 158.173.155.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.48.19
country_id: 2017370
description:
2026-07-03 00:57:02 dovecot_login authenticator failed for H=([125.129.142.200]) [81.22.48.19]:49229: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.193.5
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/budget-national-le-choix-assume-du-togo/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-07-03 00:58:29 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:52430: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.193.5
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/budget-national-le-choix-assume-du-togo/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.68
country_id: 3017382
description:
[2026-07-03 00:58:44 +0000] info [cpaneld] 5.231.64.68 - lhxhatyj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.40.120.215
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:195.40.120.215||TA:195.40.120.215||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.160.208.171
country_id: 2017370
description:
2026-07-03 01:02:52 dovecot_plain authenticator failed for H=(sbl5zlmj4hj7nu83iptk1sw1k1bx) [158.160.208.171]:37494: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.126
country_id: 1880251
description:
43.173.182.126 - - [03/Jul/2026:01:04:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805458&pdata=https%253A%252F%252Fsoena.tg%252Fproduct-category%252Fparfums%252F%253Fadd_to_wishlist%253D8172%2526_wpnonce%253D718dbd0105&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783040672 HTTP/1.1" 404 561 soena.tg "https://soena.tg/product-category/parfums/?add_to_wishlist=8172&_wpnonce=718dbd0105" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.126


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.54.238
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:162.252.54.238||TA:162.252.54.238||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-07-03 01:07:35 dovecot_login authenticator failed for H=([41.220.3.113]) [24.105.248.218]:35846: 535 Incorrect authentication data (set_id=nawoki@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.24.130.170
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/purchase/conditions HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.192
country_id: 6252001
description:
Jul  3 01:10:16 ns5 pure-ftpd[4033855]: (?@205.210.31.192) [INFO] New connection from 205.210.31.192


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.55.94.46
country_id: 6252001
domain: sodigaz.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-07-03 01:12:29 +0000] info [cpaneld] 5.230.153.74 NEW cafetg:EVjrC975wp7D5gbT address=5.230.153.74,app=cpaneld,creator=cafetg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.254.151
country_id: 3996063
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/37.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 79.136.176.110
country_id: 2017370
domain: prod.pnls.tg
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/d25f9bd38210373sradoa/fonts/d25f9bd38210.phtml||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.127.99
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:209.127.127.99||TA:209.127.127.99||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.197.56
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product/fish-burger/?add-to-cart=3633||QS:add-to-cart=3633||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-07-03 01:20:32 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:44071: 535 Incorrect authentication data (set_id=champion@soena.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-07-03 01:23:31 +0000] info [cpaneld] 134.195.82.68 NEW oviaiart:jFH0qSibEpwqxgAW address=134.195.82.68,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.127
country_id: 2635167
description:
[2026-07-03 01:23:35 +0000] info [cpaneld] 5.230.153.127 NEW oviaiart:grh7XUTX7yCVnD88 address=5.230.153.127,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.196.113.176
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/40.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-03 01:25:41 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([125.88.160.13]) [83.166.50.15]:60888: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.135.186.135
country_id: 6252001
domain: cfpj.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users/5||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [03/Jul/2026:01:26:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379297&pdata=https%253A%252F%252Fcecap.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783042015 HTTP/2.0" 302 0 cecap.tg "https://cecap.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.172.8.83
country_id: 2017370
description:
2026-07-03 01:28:30 dovecot_login authenticator failed for H=([112.165.212.135]) [5.172.8.83]:48146: 535 Incorrect authentication data (set_id=nawoki@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-03 01:28:52 dovecot_login authenticator failed for H=([124.163.202.215]) [14.42.47.150]:18045: 535 Incorrect authentication data (set_id=nawoki)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.74.128.192
country_id: 2542007
description:
2026-07-03 01:30:04 dovecot_plain authenticator failed for H=([10.88.230.127]) [105.74.128.192]:5017: 535 Incorrect authentication data (set_id=e.carine@lacs1.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.128.46.202
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/7 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.202.113.226
country_id: 6252001
description:
2026-07-03 01:34:38 dovecot_plain authenticator failed for H=(xv8sqr2tbl8uge5n7aa0urj5) [144.202.113.226]:50097: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-03 01:36:38 dovecot_login authenticator failed for H=([60.172.168.136]) [196.189.126.185]:39180: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:38:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32350: 535 Incorrect authentication data (set_id=assets@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-03 01:38:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37630: 535 Incorrect authentication data (set_id=temp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:39:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61244: 535 Incorrect authentication data (set_id=wenrong@ns5.netmaster.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.180
country_id: 6252001
description:
Jul  3 01:40:33 ns5 pure-ftpd[4049969]: (?@205.210.31.180) [INFO] New connection from 205.210.31.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:40:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47960: 535 Incorrect authentication data (set_id=lll@ns5.netmaster.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 01:41:20 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 81.30.98.144 (Iran, Islamic Republic of:IR)”


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 81.30.98.144
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.249] [Remote IP Address]=[81.30.98.144] [Authentication Database]=[mail] [Username]=[warcraft@ns5.netmaster.tg] (5/5 failures) (blocked until [Fri Jul  3 01:56:00 2026 UTC/Fri Jul  3 01:56:00 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:40:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23498: 535 Incorrect authentication data (set_id=gloria@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:42:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39472: 535 Incorrect authentication data (set_id=michela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:41:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20434: 535 Incorrect authentication data (set_id=michela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:43:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36508: 535 Incorrect authentication data (set_id=e@ns5.netmaster.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-07-03 01:44:19 +0000] info [cpaneld] 5.230.133.117 NEW oviaiart:3qprM6olea2xxV9y address=5.230.133.117,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:01:43:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792153&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Fffb26351ca0884cdba0fbb3b179a3b22%252Fb796193adc2ddcab2642e046563b2b9a%252Findex.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783043026 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/ffb26351ca0884cdba0fbb3b179a3b22/b796193adc2ddcab2642e046563b2b9a/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:44:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55520: 535 Incorrect authentication data (set_id=e@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.159.210.167
country_id: 2542007
description:
[2026-07-03 01:44:12 +0000] info [cpaneld] 105.159.210.167 - kvwytkkw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kvwytkkw (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:44:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52458: 535 Incorrect authentication data (set_id=liwj@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47134: 535 Incorrect authentication data (set_id=sochi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:47:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44200: 535 Incorrect authentication data (set_id=brio@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.148.120.249
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/97947a393ee2b9813d352d0f97fa200d_L.jpg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 93.152.221.91
country_id: 732800
domain: 24heureinfo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:48:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19952: 535 Incorrect authentication data (set_id=carlene@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:48:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60188: 535 Incorrect authentication data (set_id=ddemde@ns5.netmaster.tg)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 93.152.221.91
country_id: 732800
domain: 24heureinfo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:administratoir||User:he24djure||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:50:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54892: 535 Incorrect authentication data (set_id=count@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:50:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19474: 535 Incorrect authentication data (set_id=caz@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:52:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46628: 535 Incorrect authentication data (set_id=elite@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:51:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59716: 535 Incorrect authentication data (set_id=stormer@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:53:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22352: 535 Incorrect authentication data (set_id=cls@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:53:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62622: 535 Incorrect authentication data (set_id=wking@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-07-03 01:54:35 dovecot_plain authenticator failed for H=(sentores) [181.192.79.179]:38140: 535 Incorrect authentication data (set_id=no-reply@zephyr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:54:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27278: 535 Incorrect authentication data (set_id=rpa@ns5.netmaster.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 01:56:13 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 81.30.98.144 (Iran, Islamic Republic of:IR)”


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 81.30.98.144
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.244] [Remote IP Address]=[81.30.98.144] [Authentication Database]=[mail] [Username]=[ait@ns5.netmaster.tg] (18/5 failures) (blocked until [Fri Jul  3 02:11:12 2026 UTC/Fri Jul  3 02:11:12 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:56:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43358: 535 Incorrect authentication data (set_id=ait@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:56:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54518: 535 Incorrect authentication data (set_id=ait@ns5.netmaster.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.198.220
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/wingsn-shake/chiken-wings/wing-au-poivre-citron-5-pieces/?add-to-cart=1998||QS:add-to-cart=1998||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:57:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30302: 535 Incorrect authentication data (set_id=sammy@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.13.66.182
country_id: 953987
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-decoupage-annee-scolaire-2024-2025/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.13.66.182
country_id: 953987
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-decoupage-annee-scolaire-2024-2025/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.218.232.133
country_id: 3703430
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/6.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:57:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59528: 535 Incorrect authentication data (set_id=frame@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.150
country_id: 6252001
description:
2026-07-03 01:58:20 dovecot_plain authenticator failed for H=(1cuxsyvtibcrvhwf) [23.129.64.150]:15425: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:59:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22128: 535 Incorrect authentication data (set_id=intraweb@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.103.32.189
country_id: 3865483
description:
191.103.32.189 - - [03/Jul/2026:01:59:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001317&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-86752eitems%252Fetidm77qn.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783043956 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nwyj-86752eitems/etidm77qn.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.103.32.189


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 01:59:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43412: 535 Incorrect authentication data (set_id=lakeside@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.52.65
country_id: 2328926
domain: 24heureinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/24heureinfo.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.52.65
country_id: 2328926
domain: 24heureinfo.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/24heureinfo.tghttp/24heureinfo.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 195.2.84.198
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-00.195.2.84.198||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:00:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62374: 535 Incorrect authentication data (set_id=lakeside@ns5.netmaster.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 02:00:55 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 81.30.98.144 (Iran, Islamic Republic of:IR)”


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 81.30.98.144
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[154.70.82.249] [Remote IP Address]=[81.30.98.144] [Authentication Database]=[mail] [Username]=[contactus@ns5.netmaster.tg] (30/30 failures) (blocked until [Sat Jul  4 02:00:54 2026 UTC/Sat Jul  4 02:00:54 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:00:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27082: 535 Incorrect authentication data (set_id=fritz@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:01:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35214: 535 Incorrect authentication data (set_id=develop@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.74.162
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:206.232.74.162||TA:206.232.74.162||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 141.98.11.224
country_id: 597427
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-02.141.98.11.224||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:03:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30158: 535 Incorrect authentication data (set_id=db5@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:03:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19004: 535 Incorrect authentication data (set_id=db5@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:03:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59448: 535 Incorrect authentication data (set_id=noraldo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:05:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22032: 535 Incorrect authentication data (set_id=ys-test@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:06:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62296: 535 Incorrect authentication data (set_id=pass@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.40.121
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:145.223.40.121||TA:145.223.40.121||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.163.1
country_id: 6252001
domain: api.maquette-mpa.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/api.maquette-mpa.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:06:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26744: 535 Incorrect authentication data (set_id=embedded@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:06:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37904: 535 Incorrect authentication data (set_id=embedded@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:07:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34672: 535 Incorrect authentication data (set_id=nagiosadmin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:09:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28954: 535 Incorrect authentication data (set_id=paging@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:09:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4520: 535 Incorrect authentication data (set_id=reverse@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:10:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25742: 535 Incorrect authentication data (set_id=disco@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.208.20
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:142.111.208.20||TA:142.111.208.20||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:10:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1204: 535 Incorrect authentication data (set_id=inv@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:12:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48854: 535 Incorrect authentication data (set_id=blaine@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:12:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35474: 535 Incorrect authentication data (set_id=reuni\303\263n@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:13:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11010: 535 Incorrect authentication data (set_id=gce@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:13:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64370: 535 Incorrect authentication data (set_id=gce@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:14:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7846: 535 Incorrect authentication data (set_id=dhiren@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.78
country_id: 2635167
description:
[2026-07-03 02:15:41 +0000] info [cpaneld] 5.230.133.78 - ubwmytwf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ubwmytwf has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:16:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2500: 535 Incorrect authentication data (set_id=mishima@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 153.67.105.9
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:17:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18104: 535 Incorrect authentication data (set_id=tristan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:16:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42630: 535 Incorrect authentication data (set_id=pw@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.54.132
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:162.252.54.132||TA:162.252.54.132||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:17:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39300: 535 Incorrect authentication data (set_id=ftpmail@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:19:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33474: 535 Incorrect authentication data (set_id=newuser@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:19:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9088: 535 Incorrect authentication data (set_id=print2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:20:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37834: 535 Incorrect authentication data (set_id=guest9@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:20:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5694: 535 Incorrect authentication data (set_id=senior1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:22:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53300: 535 Incorrect authentication data (set_id=clinica@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:23:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28816: 535 Incorrect authentication data (set_id=townhall@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:24:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44772: 535 Incorrect authentication data (set_id=accepted@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:23:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15652: 535 Incorrect authentication data (set_id=securite@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:25:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31664: 535 Incorrect authentication data (set_id=carroll@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:26:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60764: 535 Incorrect authentication data (set_id=answer@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:26:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47650: 535 Incorrect authentication data (set_id=host1@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:28:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52328: 535 Incorrect authentication data (set_id=ns@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:27:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44564: 535 Incorrect authentication data (set_id=ns@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:29:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39324: 535 Incorrect authentication data (set_id=acacia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:29:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15042: 535 Incorrect authentication data (set_id=eas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:30:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44136: 535 Incorrect authentication data (set_id=harrison1@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:31:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52158: 535 Incorrect authentication data (set_id=transformation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:32:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6484: 535 Incorrect authentication data (set_id=transformation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:32:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46584: 535 Incorrect authentication data (set_id=sklad@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:33:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22122: 535 Incorrect authentication data (set_id=driver@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:35:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37802: 535 Incorrect authentication data (set_id=jeroen@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:35:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26648: 535 Incorrect authentication data (set_id=jeroen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:36:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13442: 535 Incorrect authentication data (set_id=horus@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:36:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53558: 535 Incorrect authentication data (set_id=siteweb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:38:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4728: 535 Incorrect authentication data (set_id=t7@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:39:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44864: 535 Incorrect authentication data (set_id=kissa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:39:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17322: 535 Incorrect authentication data (set_id=kissa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:39:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20448: 535 Incorrect authentication data (set_id=assistance@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:40:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33060: 535 Incorrect authentication data (set_id=cams@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:42:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11786: 535 Incorrect authentication data (set_id=treasure@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:42:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33068: 535 Incorrect authentication data (set_id=xguest@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:43:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51868: 535 Incorrect authentication data (set_id=xguest@ns5.netmaster.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 101.43.243.161
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/manifestation-a-kpome-la-famille-dagbokpe-non-associee-tg/<script async src=||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:43:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64544: 535 Incorrect authentication data (set_id=cassandra@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:45:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43360: 535 Incorrect authentication data (set_id=kitahara@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:46:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18896: 535 Incorrect authentication data (set_id=miele@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:46:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55862: 535 Incorrect authentication data (set_id=miele@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:46:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31488: 535 Incorrect authentication data (set_id=harada@ns5.netmaster.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.154.111.43
country_id: 1819730
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/fesdev-poursuit-son-engagement-au-profit-des-jeunes-dans-les-lacs/<script async src=||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:48:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10220: 535 Incorrect authentication data (set_id=lora@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.113.240.67
country_id: 3469034
description:
189.113.240.67 - - [03/Jul/2026:02:48:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947034&pdata=https%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783046892 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.113.240.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:49:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22744: 535 Incorrect authentication data (set_id=vinzenz@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.214.137.77
country_id: 690791
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/bitter-lemon HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:49:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62774: 535 Incorrect authentication data (set_id=psp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:49:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25816: 535 Incorrect authentication data (set_id=psp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:50:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22550: 535 Incorrect authentication data (set_id=backoffice@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:52:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17136: 535 Incorrect authentication data (set_id=prompt@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.115.134
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:45.133.115.134||TA:45.133.115.134||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:52:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57294: 535 Incorrect authentication data (set_id=register@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:53:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14028: 535 Incorrect authentication data (set_id=hope@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 62.201.243.5
country_id: 99237
description:
62.201.243.5 - - [03/Jul/2026:02:54:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948839&pdata=https%253A%252F%252Fmacite.tg%252F2023%252F10%252F09%252Floi-de-finances-rectificative-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783047279 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2023/10/09/loi-de-finances-rectificative-2023/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.9732.1864 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:62.201.243.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:53:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54142: 535 Incorrect authentication data (set_id=megumi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-03 02:55:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48576: 535 Incorrect authentication data (set_id=schulung@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:02:56:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027439&pdata=https%253A%252F%252Fkpmg.tg%252F0f109e0dddfaa8b0af5e8aa73f13b263%252Fdff45bb146532e1a818aa3cada1652eb%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783047374 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/0f109e0dddfaa8b0af5e8aa73f13b263/dff45bb146532e1a818aa3cada1652eb/index.php?cmd=newupld" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.85.174
country_id: 3686110
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/nouvelle-gamme-de-produits HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:03:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7365014&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783047751 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/index.php?cmd=newupld" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.184.236.166
country_id: 130758
description:
2026-07-03 03:01:45 dovecot_plain authenticator failed for H=(misratic) [2.184.236.166]:37766: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.96.118.21
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:44394.togodailynews.tg||ServerName:togodailynews.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:486ed6f5efd1f5b1fe09bd2c6d8c53a44c798a2f||Title:0x5e27b32f||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:06:51 dovecot_login authenticator failed for H=(AkYCVQ) [165.154.239.54]:52716: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.36.137
country_id: 2510769
description:
2026-07-03 03:07:27 dovecot_plain authenticator failed for H=([69.172.210.47]) [90.164.36.137]:41834: 535 Incorrect authentication data (set_id=info@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.0.155.76
country_id: 3469034
description:
2026-07-03 03:07:43 dovecot_plain authenticator failed for H=([69.172.210.47]) [143.0.155.76]:21878: 535 Incorrect authentication data (set_id=admin@sotranetogo.com)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 03:07:59 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 165.154.239.54 (Germany:DE)”


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.0.155.76
country_id: 3469034
description:
2026-07-03 03:07:50 dovecot_login authenticator failed for H=([69.172.210.47]) [143.0.155.76]:21878: 535 Incorrect authentication data (set_id=admin@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:07:59 dovecot_login authenticator failed for H=(hUzOpOypQ) [165.154.239.54]:53915: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.96.118.21
country_id: 192950
domain: togofeed.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:12656.togofeed.com||ServerName:togofeed.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4844afc34e1b5c1dccc28c01d81c9eac273c0931||Title:0x242f25e7||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:03:08:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262891&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F475cbf0e239ed73967d9e29c88977295%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783048115 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/475cbf0e239ed73967d9e29c88977295/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 165.154.239.54
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Remote IP Address]=[165.154.239.54] [Authentication Database]=[mail] [Username]=[adt-togo@cafe.tg] (5/5 failures) (blocked until [Fri Jul  3 03:22:57 2026 UTC/Fri Jul  3 03:22:57 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.167.24
country_id: 2542007
description:
2026-07-03 03:08:35 dovecot_plain authenticator failed for H=([69.172.210.47]) [197.147.167.24]:34972: 535 Incorrect authentication data (set_id=contato@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.149.169
country_id: 1643084
description:
2026-07-03 03:08:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.91.149.169]:42636: 535 Incorrect authentication data (set_id=support@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.162.92
country_id: 1512440
description:
2026-07-03 03:08:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [31.148.162.92]:3552: 535 Incorrect authentication data (set_id=marketing@sotranetogo.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.82.99.148
country_id: 6252001
description:
23.82.99.148 - - [03/Jul/2026:03:09:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922661&pdata=http%253A%252F%252Fnstreampro.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783048166 HTTP/1.1" 302 0 nstreampro.com "http://nstreampro.com/" "Mozilla/5.0 (Linux; arm_64; Android 16; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.304 YaBrowser/26.6.0.304.00 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.82.99.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.122.224.58
country_id: 3865483
description:
2026-07-03 03:09:36 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.122.224.58]:18803: 535 Incorrect authentication data (set_id=it@sotranetogo.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.115.1.202
country_id: 934292
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/ayizan-2023-apotheose HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.188.63.215
country_id: 3017382
description:
2026-07-03 03:09:04 dovecot_plain authenticator failed for H=88-188-63-215.subs.proxad.net ([69.172.210.47]) [88.188.63.215]:2063: 535 Incorrect authentication data (set_id=financeiro@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:09:05 dovecot_login authenticator failed for H=(JQr62q) [165.154.239.54]:58163: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.105.12
country_id: 2542007
description:
2026-07-03 03:08:51 dovecot_plain authenticator failed for H=([69.172.210.47]) [197.147.105.12]:49350: 535 Incorrect authentication data (set_id=contacto@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.168.251.173
country_id: 3996063
description:
2026-07-03 03:09:19 dovecot_plain authenticator failed for H=([69.172.210.47]) [187.168.251.173]:41878: 535 Incorrect authentication data (set_id=comercial@sotranetogo.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.84.199.24
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[pure-ftpd] [Local IP Address]=[154.70.82.246] [Local Port]=[21] [Remote IP Address]=[47.84.199.24] [Authentication Database]=[system] [Username]=[Jqi4OXyrrl] (1/30 failures) (blocked until [Sat Jul  4 03:10:12 2026 UTC/Sat Jul  4 03:10:12 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.120.28.176
country_id: 3469034
description:
2026-07-03 03:10:21 dovecot_plain authenticator failed for H=([69.172.210.47]) [187.120.28.176]:15488: 535 Incorrect authentication data (set_id=hr@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:09:50 dovecot_login authenticator failed for H=(wI2RW8O) [165.154.239.54]:54595: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.24.80.188
country_id: 2017370
description:
2026-07-03 03:09:50 dovecot_plain authenticator failed for H=95-24-80-188.broadband.corbina.ru ([69.172.210.47]) [95.24.80.188]:13186: 535 Incorrect authentication data (set_id=accounts@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.250.192.45
country_id: 3686110
description:
2026-07-03 03:10:05 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.250.192.45]:42496: 535 Incorrect authentication data (set_id=suporte@sotranetogo.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jul  3 03:10:16 ns5 pure-ftpd[4096419]: (?@47.84.199.24) [WARNING] Authentication failed for user [Jqi4OXyrrl]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.122.245
country_id: 99237
description:
2026-07-03 03:10:43 dovecot_plain authenticator failed for H=([69.172.210.47]) [212.237.122.245]:28329: 535 Incorrect authentication data (set_id=soporte@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:10:51 dovecot_login authenticator failed for H=(MnqlHIR) [165.154.239.54]:61374: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.122.245
country_id: 99237
description:
2026-07-03 03:10:50 dovecot_login authenticator failed for H=([69.172.210.47]) [212.237.122.245]:28329: 535 Incorrect authentication data (set_id=soporte@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.174.149.115
country_id: 3865483
description:
2026-07-03 03:11:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.174.149.115]:17703: 535 Incorrect authentication data (set_id=ventas@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.255.104.159
country_id: 3895114
description:
2026-07-03 03:11:16 dovecot_plain authenticator failed for H=([69.172.210.47]) [143.255.104.159]:58622: 535 Incorrect authentication data (set_id=clients@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.234.157.228
country_id: 102358
description:
2026-07-03 03:11:30 dovecot_plain authenticator failed for H=([69.172.210.47]) [128.234.157.228]:57224: 535 Incorrect authentication data (set_id=info@sotranetogo.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:11:13 dovecot_login authenticator failed for H=(xpfPwx) [165.154.239.54]:54785: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:11:55 dovecot_login authenticator failed for H=(IrL4G4dI) [165.154.239.54]:56306: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [03/Jul/2026:03:13:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200241&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783048416 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:13:06 dovecot_login authenticator failed for H=(LyXG3XHPM) [165.154.239.54]:54007: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.96.118.21
country_id: 192950
domain: togointerim.net
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43750.togointerim.net||ServerName:togointerim.net||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b7512262f416069731c8a7d94c9129661ed0a688||Title:0x5b278556||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:13:47 dovecot_login authenticator failed for H=(Lpir0wsuY6) [165.154.239.54]:60219: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:14:50 dovecot_login authenticator failed for H=(k9t3R3Mp) [165.154.239.54]:61153: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:15:59 dovecot_login authenticator failed for H=(h8PhuN) [165.154.239.54]:53686: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:16:04 dovecot_login authenticator failed for H=(YmVtegcOxC) [165.154.239.54]:54453: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 03:16:59 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 165.154.239.54 (Germany:DE)”


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 165.154.239.54
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Remote IP Address]=[165.154.239.54] [Authentication Database]=[mail] [Username]=[adt-togo@cafe.tg] (30/30 failures) (blocked until [Sat Jul  4 03:16:57 2026 UTC/Sat Jul  4 03:16:57 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:16:56 dovecot_login authenticator failed for H=(EJRqKcNi) [165.154.239.54]:52564: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:18:23 dovecot_login authenticator failed for H=(XTENMmld) [165.154.239.54]:54218: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.217.229.118
country_id: 1814991
description:
[2026-07-03 03:17:53 +0000] info [whostmgrd] 114.217.229.118 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 122.187.101.182
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 122.187.101.182: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:17:54 dovecot_login authenticator failed for H=(ZcNF6d0C) [165.154.239.54]:56746: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:18:45 dovecot_login authenticator failed for H=(GwY4f8RGOZ) [165.154.239.54]:57546: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.78.221
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/apotheose-odon-itsu-2023 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:20:07 dovecot_login authenticator failed for H=(SqVKzaF) [165.154.239.54]:51109: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.25.174
country_id: 1562822
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2022/05/21/upf-togo-loic-lawson-reelu-pour-un-dernier-mandat/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.122.157
country_id: 3437598
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/sample-page/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:20:48 dovecot_login authenticator failed for H=(3Z1jjNTpqg) [165.154.239.54]:50718: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:20:47 dovecot_login authenticator failed for H=(d5zC94zc2) [165.154.239.54]:56529: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:21:50 dovecot_login authenticator failed for H=(whzrv0) [165.154.239.54]:62239: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:23:25 dovecot_login authenticator failed for H=(WUaEHA7z) [165.154.239.54]:65434: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.68.206.195
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/contact HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:23:02 dovecot_login authenticator failed for H=(o4tx6K6yls) [165.154.239.54]:49865: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:23:51 dovecot_login authenticator failed for H=(N2OzHvpOdO) [165.154.239.54]:62644: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.171.211
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:140.235.171.211||TA:140.235.171.211||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:25:05 dovecot_login authenticator failed for H=(dGASGzGn) [165.154.239.54]:59722: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:26:02 dovecot_login authenticator failed for H=(XlA62afItS) [165.154.239.54]:64107: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:25:47 dovecot_login authenticator failed for H=(tIcAKHm2) [165.154.239.54]:59709: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:27:29 dovecot_login authenticator failed for H=(kUum3WEo) [165.154.239.54]:53266: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:26:50 dovecot_login authenticator failed for H=(bDsVpUZ7A) [165.154.239.54]:56227: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:27:47 dovecot_login authenticator failed for H=(ZTmYqZO64) [165.154.239.54]:56293: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:28:50 dovecot_login authenticator failed for H=(nq2kQC9Y) [165.154.239.54]:54321: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:29:12 dovecot_login authenticator failed for H=(HNnAhZu) [165.154.239.54]:58634: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:29:52 dovecot_login authenticator failed for H=(m2Oa5O) [165.154.239.54]:52668: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.61.219.217
country_id: 2017370
domain: mesyscom.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:_mc4wp_honeypot||MV:1' UNION SELECT NULL-- -||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 91.132.124.157
country_id: 6252001
domain: mesyscom.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:_mc4wp_honeypot||MV:1\".',(abc)d||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:30:59 dovecot_login authenticator failed for H=(8HZZXX) [165.154.239.54]:64706: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:30:58 dovecot_login authenticator failed for H=(KWxFUwZIjo) [165.154.239.54]:58806: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:32:31 dovecot_login authenticator failed for H=(6YYe8lTiIf) [165.154.239.54]:64871: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:31:44 dovecot_login authenticator failed for H=(M47ImcZK6) [165.154.239.54]:58781: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-07-03 03:33:41 +0000] info [cpaneld] 5.230.153.23 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:32:49 dovecot_login authenticator failed for H=(49UFPX) [165.154.239.54]:59072: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.120.221
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/17.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:33:51 dovecot_login authenticator failed for H=(AJY47x73) [165.154.239.54]:63961: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.22.35.83
country_id: 3469034
domain: www.maine.gov
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maine.gov/pfr/insurance/press/mending-health-notifies-maine-bureau-of-insurance-that-it-will-cease-offering-health-insurance-plans HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.22.35.83
country_id: 3469034
domain: www.kyoritsu-pub.co.jp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kyoritsu-pub.co.jp/book/netshop?bookid=10005524&netshop_id=honyaclub&netshop_no=10235 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.103
country_id: 1880251
description:
47.128.122.103 - - [03/Jul/2026:03:34:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065558&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcrise-du-golfe-afreximbank-protege-les-economies-africaines-et-caribeennes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783049640 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/crise-du-golfe-afreximbank-protege-les-economies-africaines-et-caribeennes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.103


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:34:21 dovecot_login authenticator failed for H=(YdbDsi) [165.154.239.54]:49392: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:34:56 dovecot_login authenticator failed for H=(Gr8BMNA) [165.154.239.54]:62630: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 212.87.194.3
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Track file upload for Infectors||RSV:8.23||T:APACHE||SC:/home/wcnyaruu/public_html/goods.php||User:wcnyaruu||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:35:47 dovecot_login authenticator failed for H=(cY0pLQ) [165.154.239.54]:60791: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:35:55 dovecot_login authenticator failed for H=(PN8knM) [165.154.239.54]:52462: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.245.27.115
country_id: 1643084
description:
[2026-07-03 03:35:58 +0000] info [cpaneld] 103.245.27.115 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:37:36 dovecot_login authenticator failed for H=(R5hfOFx) [165.154.239.54]:62338: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:36:50 dovecot_login authenticator failed for H=(6XnnLDF) [165.154.239.54]:52466: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.233.202.145
country_id: 3996063
description:
2026-07-03 03:38:07 dovecot_plain authenticator failed for H=([69.172.210.47]) [187.233.202.145]:58514: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.0.74.166
country_id: 3469034
description:
2026-07-03 03:38:22 dovecot_plain authenticator failed for H=([69.172.210.47]) [143.0.74.166]:36917: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:37:47 dovecot_login authenticator failed for H=(lljBm8) [165.154.239.54]:52771: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.114.35.57
country_id: 953987
description:
2026-07-03 03:38:39 dovecot_plain authenticator failed for H=([69.172.210.47]) [41.114.35.57]:64786: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.114.35.57
country_id: 953987
description:
2026-07-03 03:38:47 dovecot_login authenticator failed for H=([69.172.210.47]) [41.114.35.57]:64786: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:38:51 dovecot_login authenticator failed for H=(evHqYqBSoU) [165.154.239.54]:56003: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:39:16 dovecot_login authenticator failed for H=(h320eCDx) [165.154.239.54]:61485: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [03/Jul/2026:03:39:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183573&pdata=http%253A%252F%252Fjlkjum.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783049959 HTTP/1.1" 302 0 jlkjum.mediatopnews.tg "http://jlkjum.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.192.119.31
country_id: 290557
description:
2026-07-03 03:38:52 dovecot_plain authenticator failed for H=([69.172.210.47]) [5.192.119.31]:24094: 535 Incorrect authentication data (set_id=marketing@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.8.144
country_id: 3865483
description:
2026-07-03 03:39:16 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.230.8.144]:40574: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.62.180.127
country_id: 3469034
description:
2026-07-03 03:39:30 dovecot_plain authenticator failed for H=([69.172.210.47]) [187.62.180.127]:36100: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:39:49 dovecot_login authenticator failed for H=(oI0MDizUp) [165.154.239.54]:51087: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.121.73.139
country_id: 294640
description:
2026-07-03 03:40:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [46.121.73.139]:38762: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.109.22.102
country_id: 2017370
description:
2026-07-03 03:39:45 dovecot_plain authenticator failed for H=([69.172.210.47]) [185.109.22.102]:22864: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.106.231.171
country_id: 294640
description:
2026-07-03 03:40:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [176.106.231.171]:51370: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.51.89.155
country_id: 1282988
description:
2026-07-03 03:40:16 dovecot_plain authenticator failed for H=([69.172.210.47]) [202.51.89.155]:44387: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.172.186.161
country_id: 1562822
description:
2026-07-03 03:41:05 dovecot_plain authenticator failed for H=([69.172.210.47]) [113.172.186.161]:46670: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.65
country_id: 1880251
description:
47.128.121.65 - - [03/Jul/2026:03:40:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052441&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Finternationale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783050043 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/internationale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.168.124.170
country_id: 3686110
description:
2026-07-03 03:40:46 dovecot_plain authenticator failed for H=([69.172.210.47]) [186.168.124.170]:49572: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:40:53 dovecot_login authenticator failed for H=(letB86VzL) [165.154.239.54]:54183: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.196.12
country_id: 1733045
description:
2026-07-03 03:41:23 dovecot_plain authenticator failed for H=([69.172.210.47]) [115.135.196.12]:16561: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.121.71
country_id: 953987
description:
2026-07-03 03:41:40 dovecot_plain authenticator failed for H=([69.172.210.47]) [197.184.121.71]:43854: 535 Incorrect authentication data (set_id=office@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:40:46 dovecot_login authenticator failed for H=(xbIZb7) [165.154.239.54]:64986: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 106.63.27.66
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 106.63.27.66: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 106.63.27.77
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 106.63.27.77: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 106.63.27.73
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 106.63.27.73: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.84.245.130
country_id: 3469034
description:
2026-07-03 03:42:34 dovecot_plain authenticator failed for H=177-84-245-130.4inet.net.br ([69.172.210.47]) [177.84.245.130]:14742: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.228.150.182
country_id: 1733045
description:
2026-07-03 03:42:02 dovecot_plain authenticator failed for H=([69.172.210.47]) [192.228.150.182]:51430: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.121.71
country_id: 953987
description:
2026-07-03 03:41:47 dovecot_login authenticator failed for H=([69.172.210.47]) [197.184.121.71]:43854: 535 Incorrect authentication data (set_id=office@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.44
country_id: 6252001
description:
205.169.39.44 - - [03/Jul/2026:03:42:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985321&pdata=https%253A%252F%252Fwww.api.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783050121 HTTP/2.0" 302 0 www.api.sodigaz.tg "https://www.api.sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.44


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.184.80
country_id: 3437598
description:
2026-07-03 03:42:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.117.184.80]:4848: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.16.184.114
country_id: 3437598
description:
186.16.184.114 - - [03/Jul/2026:03:42:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278151&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fenseignants-regionaux-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783050154 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/enseignants-regionaux-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.5166.1454 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.16.184.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:41:48 dovecot_login authenticator failed for H=(cMJTIbAO) [165.154.239.54]:64065: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:42:28 dovecot_login authenticator failed for H=(HsYQspwyt) [165.154.239.54]:62761: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:42:47 dovecot_login authenticator failed for H=(16sFlZ) [165.154.239.54]:53084: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.234.45.212
country_id: 6252001
description:
2026-07-03 03:42:49 dovecot_plain authenticator failed for H=([69.172.210.47]) [69.234.45.212]:60938: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [03/Jul/2026:03:43:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199764&pdata=https%253A%252F%252Fwww.refonte.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783050190 HTTP/2.0" 302 0 www.refonte.sodigaz.tg "https://www.refonte.sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 94.154.127.225
country_id: 174982
domain: mesyscom.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:EMAIL||MV:1' UNION SELECT NULL-- -||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 157.22.19.101
country_id: 2661886
domain: mesyscom.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:your-email||MV:1' UNION SELECT NULL-- -||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:03:44:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171016&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783050281 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/index.php?cmd=login/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:44:02 dovecot_login authenticator failed for H=(LV3kXHG2Pc) [165.154.239.54]:60214: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 178.20.212.221
country_id: 241170
domain: mesyscom.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:_wpcf7_version||MV:6.1.5' UNION SELECT NULL-- -||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:43:51 dovecot_login authenticator failed for H=(GOIE6yO) [165.154.239.54]:54676: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:45:44 dovecot_login authenticator failed for H=(2JD00O1) [165.154.239.54]:63129: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:45:00 dovecot_login authenticator failed for H=(epz6cZ9W) [165.154.239.54]:52013: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.72.198.167
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/fete-traditionnelle-evala-2023 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:45:52 dovecot_login authenticator failed for H=(rO9XANAh2) [165.154.239.54]:63432: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.21.136.175
country_id: 732800
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/events HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:47:23 dovecot_login authenticator failed for H=(CDDrt4Bls) [165.154.239.54]:59392: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:46:55 dovecot_login authenticator failed for H=(OGYMJSkD2) [165.154.239.54]:62359: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.21
country_id: 6252001
description:
205.169.39.21 - - [03/Jul/2026:03:47:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105906&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783050426 HTTP/1.1" 302 0 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.252.109.212
country_id: 6252001
description:
44.252.109.212 - - [03/Jul/2026:03:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446955&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e%252Findex.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783050490 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.252.109.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:47:49 dovecot_login authenticator failed for H=(OMRGwQRmMs) [165.154.239.54]:56578: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:48:47 dovecot_login authenticator failed for H=(5gcAkk) [165.154.239.54]:62618: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:49:08 dovecot_login authenticator failed for H=(Ilxb2Is) [165.154.239.54]:62326: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.182.69.197
country_id: 130758
description:
2026-07-03 03:49:21 dovecot_login authenticator failed for H=(94.154.35.215) [2.182.69.197]:54979: 535 Incorrect authentication data (set_id=contact@toumida.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:50:40 dovecot_login authenticator failed for H=(EvYrMBn) [165.154.239.54]:64163: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:49:53 dovecot_login authenticator failed for H=(J0yfgjCB) [165.154.239.54]:56906: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:50:54 dovecot_login authenticator failed for H=(fCrg3WQ) [165.154.239.54]:57971: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:52:20 dovecot_login authenticator failed for H=(0LKLjTy87A) [165.154.239.54]:56412: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:51:55 dovecot_login authenticator failed for H=(xiCmH7z) [165.154.239.54]:55271: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:52:49 dovecot_login authenticator failed for H=(P9dZQ0E) [165.154.239.54]:56177: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:53:59 dovecot_login authenticator failed for H=(LXsXxG) [165.154.239.54]:61375: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:53:48 dovecot_login authenticator failed for H=(ltrcBH) [165.154.239.54]:60410: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:54:49 dovecot_login authenticator failed for H=(dWrKQtKA) [165.154.239.54]:58913: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:55:43 dovecot_login authenticator failed for H=(B0MaR6j) [165.154.239.54]:57384: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.239.54
country_id: 2921044
description:
2026-07-03 03:55:48 dovecot_login authenticator failed for H=(6fM13TP) [165.154.239.54]:58473: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.245.27.115
country_id: 1643084
description:
[2026-07-03 03:58:30 +0000] info [cpaneld] 103.245.27.115 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.159.170.150
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/46.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.92.204
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/journee-du-1er-juin-a-la-snb HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-03 04:01:01 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net ([94.16.17.141]) [24.119.52.56]:44464: 535 Incorrect authentication data (set_id=katakpamey@otr.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.181.25
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:108.165.181.25||TA:108.165.181.25||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 158.62.53.98
country_id: 1694008
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45bd52d94a2bfa720f53cd451d8b9ce5aff0328f||Title:wfakjzqp9w0561koi||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.92.242.55
country_id: 2750405
description:
[2026-07-03 04:03:07 +0000] info [cpaneld] 91.92.242.55 - hcbcmrio "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 216.26.251.211
country_id: 6251999
domain: sp-eau.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:doufelg||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.3.44.108
country_id: 2510769
domain: sp-eau.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:doufelg||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.49
country_id: 2635167
description:
[2026-07-03 04:07:32 +0000] info [cpaneld] 5.230.153.49 - sxoyfjqv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:04:12:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997359&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e%252Fd8574f4cd8a5ff9a4c8df1c3a65f526f%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783051937 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e/d8574f4cd8a5ff9a4c8df1c3a65f526f/index.php?cmd=login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.252.109.212
country_id: 6252001
description:
44.252.109.212 - - [03/Jul/2026:04:12:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263402&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783051963 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/index.php?cmd=newupld/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.252.109.212


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.57.62.218
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/ckool-1 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [03/Jul/2026:04:15:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185670&pdata=http%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783052104 HTTP/1.1" 302 0 zismaz.mediatopnews.tg "http://zismaz.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.64.206.223
country_id: 294640
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/videos HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.199
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:pnls||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 104.28.219.199
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.old||RSV:8.23||T:APACHE||REQUEST_URI:/wp-config.php.old||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.219.199
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.28.219.199||TA:104.28.219.199||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.87.215.220
country_id: 1210997
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2023/09/07/elim-can-feminine-2024-la-liste-du-togo-face-au-djibouti/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.64.206.223
country_id: 294640
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/videos/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.55.108.206
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/remise-de-don-au-canton-dadetikope HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.151.100.180
country_id: 3624060
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/videos HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.204.153.114
country_id: 3625428
description:
2026-07-03 04:19:11 dovecot_login authenticator failed for H=(94.154.35.215) [190.204.153.114]:40720: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.161.2.210
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/chap-cocktail HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.240.124
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/career HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.203.210
country_id: 2542007
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/siteweb/public/videos/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.192.61
country_id: 1512440
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-pilsner-donne-la-joie-aux-amoureux-du-ballon-rond HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.195
country_id: 2661886
description:
193.189.100.195 - zxtqbmmj [03/Jul/2026:04:23:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145753&pdata=https%253A%252F%252Fperfect-labo.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783052599 HTTP/2.0" 302 0 perfect-labo.com "https://perfect-labo.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.195


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.84.199.24
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[pure-ftpd] [Local IP Address]=[154.70.82.246] [Local Port]=[21] [Remote IP Address]=[47.84.199.24] [Authentication Database]=[system] [Username]=[turbolte] (1/30 failures) (blocked until [Sat Jul  4 04:23:29 2026 UTC/Sat Jul  4 04:23:29 2026 LOCAL])


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jul  3 04:23:35 ns5 pure-ftpd[4133349]: (?@47.84.199.24) [WARNING] Authentication failed for user [turbolte]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.237.60
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/72.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:04:24:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235477&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252F5a62aa212b86bc08a2d77c395174ea68%252F8a5e8e4b08af2effd9daa8105741ce34%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783052672 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/5a62aa212b86bc08a2d77c395174ea68/8a5e8e4b08af2effd9daa8105741ce34/index.php?cmd=newupld/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 189.69.168.176
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sanlam.com||User:egjvuiox||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.69.168.176
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.sanlam.com HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.85.54.117
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-togo-2000 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.177
country_id: 130758
domain: conseilnsaftogo.org
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=id,slug,name,link,roles||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.89.10.184
country_id: 6252001
description:
35.89.10.184 - - [03/Jul/2026:04:33:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146781&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Fffb26351ca0884cdba0fbb3b179a3b22%252Fb796193adc2ddcab2642e046563b2b9a%252Findex.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783053234 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/ffb26351ca0884cdba0fbb3b179a3b22/b796193adc2ddcab2642e046563b2b9a/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.89.10.184


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 176.126.111.54
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:176.126.111.54||TA:176.126.111.54||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 174.64.199.79
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-48.174.64.199.79||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.252.109.212
country_id: 6252001
description:
44.252.109.212 - - [03/Jul/2026:04:49:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6383767&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252F5a62aa212b86bc08a2d77c395174ea68%252F53e05f3a2e9baf658df1f5afabd4036d%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783054169 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/5a62aa212b86bc08a2d77c395174ea68/53e05f3a2e9baf658df1f5afabd4036d/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.252.109.212


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.77.139.154
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-pilsner-a-sokode HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.144.35.181
country_id: 6252001
description:
16.144.35.181 - - [03/Jul/2026:04:54:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883353&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776%252F8c32bedce4ca929e901353d4db9eebcc%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783054490 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776/8c32bedce4ca929e901353d4db9eebcc/index.php?cmd=newupld/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.144.35.181


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.13.223.178
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.13.223.178: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [03/Jul/2026:04:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9990291&pdata=http%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783054537 HTTP/1.1" 302 0 zismaz.mediatopnews.tg "http://zismaz.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.108
country_id: 6252001
description:
Jul  3 05:00:29 ns5 pure-ftpd[4155585]: (?@198.235.24.108) [INFO] New connection from 198.235.24.108


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 123.136.113.162
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 123.136.113.162: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.106.91
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/73.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 123.136.113.163
country_id: 1733045
description:
Denial of Service (DoS) attack was discovered from 123.136.113.163: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.155.74.42
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/nafa-vers-une-nouvelle-architecture-financiere-africaine/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.155.74.42
country_id: 192950
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/nafa-vers-une-nouvelle-architecture-financiere-africaine/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.60.22
country_id: 1562822
description:
2026-07-03 05:07:27 dovecot_login authenticator failed for H=([47.85.189.23]) [27.71.60.22]:38760: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.207.83.178
country_id: 1282988
domain: www.perfect-labo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.perfect-labo.com/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.238.17.249
country_id: 3996063
domain: letabloid.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tghttp/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.238.17.249
country_id: 3996063
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 16.144.35.181
country_id: 6252001
description:
16.144.35.181 - - [03/Jul/2026:05:10:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12765080&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F3ab2e605cafab0f046b95d461a96be5c&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783055447 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/3ab2e605cafab0f046b95d461a96be5c" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:16.144.35.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [03/Jul/2026:05:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661593&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783055435 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.249
country_id: 1880251
description:
43.173.175.249 - - [03/Jul/2026:05:12:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247462&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fcat%253D8%2526page%253D14&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783055560 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?cat=8&page=14" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.249


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [03/Jul/2026:05:14:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248235&pdata=https%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783055695 HTTP/2.0" 302 0 zismaz.mediatopnews.tg "https://zismaz.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:05:14:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405524&pdata=https%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783055695 HTTP/2.0" 302 0 zismaz.mediatopnews.tg "https://zismaz.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.112.62.56
country_id: 1210997
domain: cfpj.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users/2?_fields=id,slug,roles||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.93.215.137
country_id: 1694008
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/tag/echange-au-tour-de-lmu/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.84.199.24
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[pure-ftpd] [Local IP Address]=[154.70.82.246] [Local Port]=[21] [Remote IP Address]=[47.84.199.24] [Authentication Database]=[system] [Username]=[admin] (1/30 failures) (blocked until [Sat Jul  4 05:14:12 2026 UTC/Sat Jul  4 05:14:12 2026 LOCAL])


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jul  3 05:14:15 ns5 pure-ftpd[4167128]: (?@47.84.199.24) [WARNING] Authentication failed for user [admin]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.173.34.179
country_id: 298795
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/13.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.132.125.119
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:91.132.125.119||TA:91.132.125.119||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:05:21:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881750&pdata=http%253A%252F%252Fconfortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783056105 HTTP/1.1" 302 0 confortis.tg "http://confortis.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 8.215.24.140
country_id: 1643084
description:
Jul  3 05:24:49 ns5 pure-ftpd[4175557]: (?@8.215.24.140) [WARNING] Authentication failed for user [rolle]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.120.4.8
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cantines-35-000-eleves-beneficiaires-en-2025-dans-les-plateaux/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.120.4.8
country_id: 2542007
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/cantines-35-000-eleves-beneficiaires-en-2025-dans-les-plateaux/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 191.99.73.235
country_id: 3658394
domain: lct-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/la-ligue-des-consommateurs-du-togo-met-en-lumiere-la-note-ministerielle-sur-les-fournitures-scolaires/www.tury-v-spb.com||User:lhxhatyj||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.210.178.156
country_id: 6252001
description:
2026-07-03 05:30:41 dovecot_plain authenticator failed for H=(2a6wy6awt5uw6lyowi4) [192.210.178.156]:54438: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.13.188
country_id: 6252001
domain: 34.221.200.0
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.221.200.0/azenv5.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.133
country_id: 1880251
description:
43.173.182.133 - - [03/Jul/2026:05:34:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461847&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F03%252F08%252Fvehicules-usagers-lotr-annonce-une-depreciation-de-30-sur-les-frais-de-douane&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783056844 HTTP/1.1" 404 561 macite.tg "https://macite.tg/2024/03/08/vehicules-usagers-lotr-annonce-une-depreciation-de-30-sur-les-frais-de-douane" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.133


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.143.214
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/21.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 174.77.111.196
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-37.174.77.111.196||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 8.215.24.140
country_id: 1643084
description:
Jul  3 05:41:50 ns5 pure-ftpd[4191708]: (?@8.215.24.140) [WARNING] Authentication failed for user [two]


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.141
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/osouper/nos-sandwichs-osouper/vegetarien/?add-to-cart=2104||QS:add-to-cart=2104||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.13.188
country_id: 6252001
domain: 34.221.200.0
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.221.200.0/azenv4.php HTTP/1.1||RSV:8.23||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.179.224.31
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 61.179.224.31: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 58.205.218.2
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 58.205.218.2: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [03/Jul/2026:05:47:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208662&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783057665 HTTP/1.1" 302 0 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.179.224.32
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 61.179.224.32: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 58.205.218.3
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 58.205.218.3: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 60.214.111.198
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 60.214.111.198: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 117.91.191.233
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 117.91.191.233: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 58.205.218.18
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 58.205.218.18: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 111.2.177.198
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 111.2.177.198: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.49.45.5
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 112.49.45.5: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.49.45.4
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 112.49.45.4: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 223.111.181.5
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 223.111.181.5: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 117.91.191.232
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 117.91.191.232: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 60.214.111.197
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 60.214.111.197: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 58.205.218.19
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 58.205.218.19: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.250.204.71
country_id: 3144096
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.250.204.71||TA:104.250.204.71||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 111.2.177.197
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 111.2.177.197: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.29.230
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/kick-off-meeting-2021 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.19
country_id: 6252001
description:
205.169.39.19 - - [03/Jul/2026:05:49:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052764&pdata=http%253A%252F%252Fl4u8i0.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783057782 HTTP/1.1" 302 0 l4u8i0.mediatopnews.tg "http://l4u8i0.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.19


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.221.64.23
country_id: 357994
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/deuxieme-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.207.124.18
country_id: 1861060
description:
43.207.124.18 - - [03/Jul/2026:05:55:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13197667&pdata=https%253A%252F%252Fwww.cameg-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783058132 HTTP/2.0" 302 0 www.cameg-togo.tg "https://www.cameg-togo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.207.124.18


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.20.198.220
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/ceremonie-de-lancement-officiel-djama-228 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ee8a7874541cfb3005b682a2aa1167c3b7c568b||Title:mnhvhnaoudgu45scr3||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa4a1b4564db472e6b0889818a1e4a1cf386dc3d||Title:9pm2su7eh1dmdtmbag||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7fcde18299eda6da35b99d106d020bbcad70284||Title:8dve1v2hd5ioq3es||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.24.62.245
country_id: 1814991
description:
[2026-07-03 05:58:13 +0000] info [cpaneld] 120.24.62.245 - dany2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dany2 (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f1568661b21f722b1f6a2d46e46430bd65be11d3||Title:qqyntyt8uc9hwj9wgc||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.190
country_id: 2750405
description:
2026-07-03 06:00:57 H=([46.151.182.190]) [46.151.182.190]:50670 F=<pago@leoni.com.mx> rejected RCPT <b.blaodekissi@ese2i.tg>: Sender verify failed


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.174.200
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product/chawarma-poulet/?add-to-cart=3563||QS:add-to-cart=3563||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.40
country_id: 1880251
description:
47.128.112.40 - - [03/Jul/2026:06:00:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6538692&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fachat-dordinateur-voici-quelques-criteres-a-prendre-en-compte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783058417 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/achat-dordinateur-voici-quelques-criteres-a-prendre-en-compte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa48ca6f055f016cc0bb68996bf1cff7ce996f8b||Title:vpkf8vj39qeugt5||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c7d21ee605ab006dd81b5e6c021da36660b3d7b4||Title:pyijg2tk29pwra||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-03 06:01:41 dovecot_login authenticator failed for H=([196.190.43.162]) [116.98.104.138]:52146: 535 Incorrect authentication data (set_id=nawoki@otr.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5d1d4f3bfa6d1c51b62ae29992f6d1825062cdbb||Title:kslc54la7554445||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9f2ae328d1a994a81abfdaacac9f7fdc612a3948||Title:zqfb80sfz51dk7xx6||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1b76ae9cf56bf39da9babba0a3f1d4d78112d2a||Title:lc3w6eoakp60anoar||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a09ea58f35db61b87a9a0b280cfe8e6e29d3a43||Title:t7q1vwq6mme80w||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30bb2518522979b5946c6f6c0ed8bd37756c4549||Title:qme7ijedkg288owz||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.31.37.147
country_id: 6252001
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.nsiassurancestogo.com||User:egjvuiox||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e9c4c892ef17cd5e2e17f559fd166bee0dcc1db3||Title:b3iuhjurevcn68||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97944b625da4d5a9deead27952766bce20eb694b||Title:7asz2gy8nyy4e0n5||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1cc33eb92d937d432764e2e82c81a4f255a4445||Title:phpu7i4ycohipa5ex||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3c54c1015d3ffd87e8498d9387c6ec4a1b52bf6e||Title:pqg3r1rg8axj5impf||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0960cead763132e559c2de42b94119e947a2a88e||Title:2kq3ys9gdh13dqv||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.198.251
country_id: 1562822
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/contact HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c345be8c4948d95a95d48468730ff3c351fcc04f||Title:jb76lymtyvs31zs2||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.207.182.254
country_id: 1694008
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2024/07/31/le-mpdd-quitte-les-coalitions-pour-une-profonde-reorganisation/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:51fd8b4fac5938925583883cb78beaf510389b50||Title:271p1jggcy71wmx||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8f9b152e8610129ae6ccf42683d71d6ea093634||Title:e65rpaj90yf9fanf||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.22
country_id: 6252001
description:
205.169.39.22 - - [03/Jul/2026:06:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738387&pdata=http%253A%252F%252Fwww.afriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783059291 HTTP/1.1" 302 0 www.afriquerevelation.tg "http://www.afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:81cff10c821086dbf9638a193447543b2063fd32||Title:s45j01p2tvxyzpel7||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52624356efed5d6e57895aaceed7e5d054ad0f7b||Title:ruq72pife38atp4r||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:70c04ed261b87c4b20de7920fd7fa4e2aef5321e||Title:b12rj1gl5zei2j6||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:39e7849982dec6bdd89c52aae9adf0058cbb3aff||Title:sqdx2f1svhy3kpi||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.170.26.232
country_id: 2363686
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/39.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf00279876c84d7cb7599681694bc466dfc8ef11||Title:2w6ccg0ur9whcj||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.58.135.229
country_id: 1269750
description:
152.58.135.229 - - [03/Jul/2026:06:20:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933723&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmedecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783059656 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/medecin-dune-clinique-privee-poursuivi-pour-avoir-viole-une-femme-mariee/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.1155.1868 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.58.135.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ed1387bcf990c0061b8661e5f60c0eb45d162e43||Title:e2hihmourmu5d0k||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90c14cb9d7e92e5f4d2f9160d887c351c65825e9||Title:prugfmrtcjagyx1i2v||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0be601fb0a930d94989a7df9bdb7c53f01d8db7||Title:gji3ub5irg4yfm6inu||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.174.28.80
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:butodra.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ef8d96b58c94a69680e7de485046777d264a8e2e||Title:ovjp6j2ptrnafebbvs||RSV:8.23||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.181.225.141
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 18.181.225.141: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.191.122.208
country_id: 1210997
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/de-lombre-a-la-lumiere-les-femmes-togolaises-saffirment-grace-a-lenergie/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.191.122.208
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/de-lombre-a-la-lumiere-les-femmes-togolaises-saffirment-grace-a-lenergie/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.47.88
country_id: 2363686
domain: nps.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77556973
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 196.170.47.88
country_id: 2363686
domain: nps.tg
description:
IM360 WAF: Malformed URI Open Redirect Probe Detected||MV:/\"https://websitedemos.net/gardening-and-landscape-02/wp-content/uploads/sites/1520/2025/03/our-story.jpg||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.170.47.88
country_id: 2363686
description:
196.170.47.88 - - [03/Jul/2026:06:27:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000287&pdata=https%253A%252F%252Fnps.tg%252Fa-propos%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783060040 HTTP/2.0" 302 0 nps.tg "https://nps.tg/a-propos/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.170.47.88


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jul  3 06:35:32 ns5 pure-ftpd[19023]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.84.199.24
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[pure-ftpd] [Local IP Address]=[154.70.82.246] [Local Port]=[21] [Remote IP Address]=[47.84.199.24] [Authentication Database]=[system] [Username]=[Turbolte] (1/30 failures) (blocked until [Sat Jul  4 06:35:26 2026 UTC/Sat Jul  4 06:35:26 2026 LOCAL])


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.83.155
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:108.165.83.155||TA:108.165.83.155||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.28.255.181
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/web/wp-json/wp/v2/users/||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.28.255.181
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.23||T:APACHE||MV:/blog/wp-json/wp/v2/users/||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.28.255.181
country_id: 6252001
domain: emt.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.23||T:APACHE||REQUEST_URI:/web/wp-includes/wlwmanifest.xml||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.28.255.181
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.28.255.181: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:06:48:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118556&pdata=http%253A%252F%252Fhaplucia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783061311 HTTP/1.1" 302 0 haplucia-togo.tg "http://haplucia-togo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.197.69.115
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/125.0.6422.60 Safari/537.36||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.146.149.182
country_id: 1282988
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/kick-off-meeting-2021 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 79.116.164.70
country_id: 2510769
domain: ameak.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10068.ameak.co||ServerName:ameak.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c188c265deb59f7adbde24247d1307e27854c902||Title:0x39e8c9b0||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:06:49:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658503&pdata=https%253A%252F%252Fhaplucia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783061354 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [03/Jul/2026:06:50:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115715&pdata=http%253A%252F%252Fv2lhxq.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783061455 HTTP/1.1" 302 0 v2lhxq.mediatopnews.tg "http://v2lhxq.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:06:50:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595545&pdata=http%253A%252F%252F154.70.82.246%252Fcgi-sys%252Fdefaultwebpage.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783061410 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/cgi-sys/defaultwebpage.cgi" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.179.5
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/pizzavi/pizza-pizzavi/pizzavi/?add-to-cart=2003||QS:add-to-cart=2003||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.238.238
country_id: 3077311
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:92.112.238.238||TA:92.112.238.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.47.144
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:145.223.47.144||TA:145.223.47.144||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 135.232.20.92
country_id: 6252001
description:
135.232.20.92 - - [03/Jul/2026:06:58:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790049&pdata=http%253A%252F%252Fwww.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783061881 HTTP/1.1" 302 0 www.snb.tg "http://www.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:135.232.20.92


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.196.9.159
country_id: 6252001
description:
103.196.9.159 - - [03/Jul/2026:07:01:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132120&pdata=https%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783062062 HTTP/2.0" 302 0 zismaz.mediatopnews.tg "https://zismaz.mediatopnews.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.196.9.159


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.207.193.224
country_id: 290557
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/14.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [03/Jul/2026:07:08:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6451094&pdata=http%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783062495 HTTP/1.1" 302 0 zismaz.mediatopnews.tg "http://zismaz.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [03/Jul/2026:07:10:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339991&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fepe-ekpe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783062611 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/epe-ekpe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-03 07:11:43 dovecot_login authenticator failed for H=(187-50-27-129.customer.tdatabrasil.net.br) [197.219.208.58]:48662: 535 Incorrect authentication data (set_id=katakpamey@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-07-03 07:13:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:52358: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.164.91.175
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:141.164.91.175||TA:141.164.91.175||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.207.184
country_id: 1562822
domain: confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/confortis.tg/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 45.196.199.22
country_id: 2017370
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.121.125.88
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-chute-du-taux-de-mortalite-hospitaliere/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.121.125.88
country_id: 1522867
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-chute-du-taux-de-mortalite-hospitaliere/ HTTP/1.1||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 49.65.18.79
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2330||QS:add-to-cart=2330||RSV:8.23||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.243.104
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.23||T:APACHE||RA:104.245.243.104||TA:104.245.243.104||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.34.205
country_id: 2395170
description:
2026-07-03 07:25:04 dovecot_login authenticator failed for H=(154.127.34.205) [154.127.34.205]:54968: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.173.155.240
country_id: 2921044
description:
Jul  3 07:27:53 ns5 pure-ftpd[38667]: (?@158.173.155.240) [INFO] New connection from 158.173.155.240


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.82.200.28
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2333||QS:add-to-cart=2333||RSV:8.23||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.56.46
country_id: 2363686
description:
2026-07-03 07:27:36 dovecot_login authenticator failed for H=(ARSE) [196.171.56.46]:49918: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.196
country_id: 2661886
description:
193.189.100.196 - utkxprkk [03/Jul/2026:07:29:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208111&pdata=https%253A%252F%252Fletempsdaider.org%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783063744 HTTP/2.0" 302 0 letempsdaider.org "https://letempsdaider.org:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.196


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - service.examens@ucao-uut.tg [07/03/2026:07:30:10 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: service.examens@ucao-uut.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.21
country_id: 6252001
description:
205.169.39.21 - - [03/Jul/2026:07:30:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315665&pdata=http%253A%252F%252Ftxohul.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783063807 HTTP/1.1" 302 0 txohul.mediatopnews.tg "http://txohul.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.21


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.176.53
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/store/seduction/?add-to-cart=9737||QS:add-to-cart=9737||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.227
country_id: 1643084
description:
[2026-07-03 07:33:15 +0000] info [cpaneld] 103.65.237.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 178.16.54.137
country_id: 2750405
domain: djama.tg:80
description:
IM360 WAF: Bad file extension||RSV:8.23||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:bighostingsnbd||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 92.242.249.54
country_id: 3202326
domain: besteva1.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91257.besteva1.com||ServerName:besteva1.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5febbc27a21db3f3eb56ef8aa2de0bbf682f8138||Title:0xcacb1863||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.152.18
country_id: 953987
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-baguida-1 HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [03/Jul/2026:07:36:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870181&pdata=https%253A%252F%252Fowuls2.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064170 HTTP/2.0" 302 0 owuls2.mediatopnews.tg "https://owuls2.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:07:37:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843496&pdata=http%253A%252F%252Fautoconfig.henkagroupe.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064275 HTTP/1.1" 302 0 autoconfig.henkagroupe.com "http://autoconfig.henkagroupe.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 109.123.245.41
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 109.123.245.41: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 207.180.221.243
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 207.180.221.243: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:07:38:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791431&pdata=http%253A%252F%252Fautoconfig.mig.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064312 HTTP/1.1" 302 0 autoconfig.mig.tg "http://autoconfig.mig.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:07:38:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276314&pdata=http%253A%252F%252Fautoconfig.mig.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064332 HTTP/1.1" 302 0 autoconfig.mig.tg "http://autoconfig.mig.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.145.183.67
country_id: 6252001
description:
[2026-07-03 07:39:04 +0000] info [whostmgrd] 76.145.183.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 122.97.68.70
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2346||QS:add-to-cart=2346||RSV:8.23||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.200
country_id: 6252001
description:
[2026-07-03 07:40:13 +0000] info [cpaneld] 107.174.169.200 NEW formationfreenet:fuBh83hEhHofRMps address=107.174.169.200,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.50.178.175
country_id: 3624060
description:
179.50.178.175 - - [03/Jul/2026:07:41:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749145&pdata=https%253A%252F%252Fwebmail.helfinger.free.netmaster.tg%252F%253Flocale%253Dnb&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064507 HTTP/2.0" 302 0 webmail.helfinger.free.netmaster.tg "https://webmail.helfinger.free.netmaster.tg/?locale=nb" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.50.178.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:07:41:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460611&pdata=http%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064518 HTTP/1.1" 302 0 matosshop.tg "http://matosshop.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.209.196.241
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 185.209.196.241: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:07:42:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065774&pdata=https%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064539 HTTP/2.0" 302 0 matosshop.tg "https://matosshop.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:07:42:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446177&pdata=http%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064524 HTTP/1.1" 302 0 matosshop.tg "http://matosshop.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.175.143
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/produit/badboy/?add-to-cart=8665||QS:add-to-cart=8665||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.221.169.75
country_id: 953987
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/gbagba-2023-apotheose HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:07:44:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277286&pdata=http%253A%252F%252Fmig.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064666 HTTP/1.1" 302 0 mig.tg "http://mig.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:07:46:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119323&pdata=http%253A%252F%252Fwebdisk.marketplace.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064771 HTTP/1.1" 302 0 webdisk.marketplace.netmaster.tg "http://webdisk.marketplace.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.159.203.45
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 51.159.203.45: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:07:46:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869976&pdata=http%253A%252F%252Fautoconfig.marketplace.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064770 HTTP/1.1" 302 0 autoconfig.marketplace.netmaster.tg "http://autoconfig.marketplace.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.bawasongroup.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; moto g41 Build/S3RWS32.138-29-5-5; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/es ByteFullLocale/es Region/MX AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [03/Jul/2026:07:47:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656361&pdata=https%253A%252F%252Fwww.bawasongroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783064838 HTTP/2.0" 302 0 www.bawasongroup.com "https://www.bawasongroup.com/" "Mozilla/5.0 (Linux; Android 12; moto g41 Build/S3RWS32.138-29-5-5; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/es ByteFullLocale/es Region/MX AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.185.171.99
country_id: 953987
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11229.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b459cdeb14cc6a857390f59cb71fa73a0f7d360f||Title:0x26040d4f||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 137.255.96.201
country_id: 2395170
domain: portailbj.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"color: rgb(0, 0, 0);\">bonjour monsieur finouh,</span></p><p><br></p><p><span style=\"color: rgb(0, 0, 0);\">nous voudrions porter \xc3\xa0 votre connaissance que la porte c\xc3\xb4t\xc3\xa9 assistante dg, \xc3\xa0 du mal \xc3\xa0 s'ouvrir et apr\xc3\xa8s le diagnotics du menuisier (mardoch\xc3\xa9e) il nous a \xc3\xa9t\xc3\xa9 confirm\xc3\xa9 que le probl\xc3\xa8me est li\xc3\xa9 au syst\xc3\xa8me d'assistance install\xc3\xa9 par mesys. c'est pourquoi nous vous invitons \xc3\xa0 passer dans nos locaux en vue de nous aider \xc3\xa0 trouver une solution.</span></p><p><br></p><p><span style=\"color: rgb(0, 0, 0);\">cdt</span></p><p><br></p>||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [03/Jul/2026:07:51:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514329&pdata=https%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783065070 HTTP/2.0" 302 0 afriquerevelation.tg "https://afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.185.171.99
country_id: 953987
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec999892aac2e904be56ccafe299475412d17a55||Title:0xa4c6ed92||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.185.171.99
country_id: 953987
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80fa087b6ecc429f86bb85e87dd1dfbbc1139ee0||Title:0xf1afdae3||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.185.171.99
country_id: 953987
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1080930cdab2fc906649d150351c6828fa9a2fd1||Title:0x9a06f580||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.185.171.99
country_id: 953987
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26dad9237821c758ca2f3db83cef4c9969b53525||Title:0x13c1911c||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 137.255.96.201
country_id: 2395170
domain: portailbj.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><strong style=\"background-color: yellow; color: rgb(31, 78, 121);\">urgence signal\xc3\xa9e !</strong></p><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">bonjour mesys,</span></p><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">nous vous prions de vous rendre en urgence \xc3\xa0 notre agence </span><strong style=\"color: rgb(31, 78, 121);\">porto novo </strong><span style=\"color: rgb(31, 78, 121);\">pour constater</span><strong style=\"color: rgb(31, 78, 121);\"> </strong><span style=\"color: rgb(31, 78, 121);\">le dysfonctionnement suivant :</span></p><ol><li data-list=\"bullet\"><span class=\"ql-ui\" contenteditable=\"false\"></span><strong style=\"color: rgb(31, 78, 121);\">le contr\xc3\xb4le d\xe2\x80\x99acc\xc3\xa8s dysfonctionne au niveau de la porte entr\xc3\xa9e bureau rsc (le lecteur en entr\xc3\xa9e ne r\xc3\xa9pond pas)</strong></li></ol><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">merc</span><strong style=\"color: rgb(31, 78, 121);\">i </strong><span style=\"color: rgb(31, 78, 121);\">de nous proposer une solution de r\xc3\xa9paration.</span></p><p><span style=\"color: rgb(31, 78, 121);\">nous vous remercions de nous communiquer \xc3\xa0 l\xe2\x80\x99avance le nom du technicien qui fera l\xe2\x80\x99intervention et pour la diligence habituelle.</span></p><p><span style=\"color: rgb(15, 71, 97);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">cordialement.</span></p>||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.185.171.99
country_id: 953987
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:locoh.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0feb10692e21f3b3d71769b7ada53acac7f2f822||Title:0xffe39216||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 137.255.96.201
country_id: 2395170
domain: portailbj.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><strong style=\"background-color: yellow; color: rgb(31, 78, 121);\">urgence signal\xc3\xa9e !</strong></p><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">bonsoir mesys,</span></p><p><span style=\"color: rgb(31, 78, 121);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">nous vous prions de vous rendre en urgence \xc3\xa0 notre agence </span><strong style=\"color: rgb(31, 78, 121);\">unafrica </strong><span style=\"color: rgb(31, 78, 121);\">pour constater</span><strong style=\"color: rgb(31, 78, 121);\"> </strong><span style=\"color: rgb(31, 78, 121);\">le dysfonctionnement suivant :</span></p><ol><li data-list=\"bullet\"><span class=\"ql-ui\" contenteditable=\"false\"></span><strong style=\"color: rgb(31, 78, 121);\">test d\xe2\x80\x99intrusion \xc3\xa0 l\xe2\x80\x99ouverture non concluant</strong></li></ol><p><span style=\"color: rgb(31, 78, 121);\">merc</span><strong style=\"color: rgb(31, 78, 121);\">i </strong><span style=\"color: rgb(31, 78, 121);\">de nous proposer une solution de r\xc3\xa9paration.</span></p><p><span style=\"color: rgb(31, 78, 121);\">nous vous remercions de nous communiquer \xc3\xa0 l\xe2\x80\x99avance le nom du technicien qui fera l\xe2\x80\x99intervention et pour la diligence habituelle.</span></p><p><span style=\"color: rgb(15, 71, 97);\"> </span></p><p><span style=\"color: rgb(31, 78, 121);\">cordialement.</span></p><p><span style=\"color: rgb(31, 78, 121);\"> </span></p>||RSV:8.23||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.53.28.143
country_id: 163843
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/54.jpeg HTTP/1.1||RSV:8.23||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:08:00:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924712&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783065636 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-07-03 08:00:37 +0000] info [webmaild] 160.242.195.10 - ldaro@caissederetraites.tg "POST /cpsess8507194374/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.97.54] != Current IP Address [160.242.195.10]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:08:03:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9728363&pdata=http%253A%252F%252Fwww.consult.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783065833 HTTP/1.1" 302 0 www.consult.sodigaz.tg "http://www.consult.sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:08:03:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014934&pdata=https%253A%252F%252Fwww.consult.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783065830 HTTP/2.0" 302 0 www.consult.sodigaz.tg "https://www.consult.sodigaz.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.254.194
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.254.194: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.177.60.58
country_id: 6252001
description:
[2026-07-03 08:04:50 +0000] info [cpaneld] 174.177.60.58 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.173.155.240
country_id: 2921044
description:
Jul  3 08:04:57 ns5 pure-ftpd[57337]: (?@158.173.155.240) [INFO] New connection from 158.173.155.240


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.31.47.128
country_id: 6252001
description:
[2026-07-03 08:04:53 +0000] info [cpaneld] 65.31.47.128 - corpsdiplomaticnews "GET /login/?login_only=1&user=corpsdiplomaticnews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdiplomaticnews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.198.12.222
country_id: 6252001
description:
[2026-07-03 08:04:57 +0000] info [cpaneld] 73.198.12.222 - corpsdiplomaticnewstg "GET /login/?login_only=1&user=corpsdiplomaticnewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdiplomaticnewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.77.133
country_id: 6252001
description:
[2026-07-03 08:05:17 +0000] info [cpaneld] 172.59.77.133 - corp "GET /login/?login_only=1&user=corp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.201.42.176
country_id: 6252001
description:
[2026-07-03 08:05:37 +0000] info [cpaneld] 75.201.42.176 - corpsdi4 "GET /login/?login_only=1&user=corpsdi4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdi4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.142.83.196
country_id: 6252001
description:
[2026-07-03 08:05:51 +0000] info [cpaneld] 69.142.83.196 - corpsdi8 "GET /login/?login_only=1&user=corpsdi8&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdi8 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.132.25.169
country_id: 6252001
description:
[2026-07-03 08:05:14 +0000] info [cpaneld] 73.132.25.169 - corps "GET /login/?login_only=1&user=corps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corps (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.85.226
country_id: 6252001
description:
[2026-07-03 08:05:56 +0000] info [cpaneld] 135.129.85.226 - corpsdi9 "GET /login/?login_only=1&user=corpsdi9&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdi9 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.134.68.125
country_id: 6252001
description:
[2026-07-03 08:05:25 +0000] info [cpaneld] 9.134.68.125 - corpsdi1 "GET /login/?login_only=1&user=corpsdi1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdi1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.229.190
country_id: 6252001
description:
[2026-07-03 08:05:33 +0000] info [cpaneld] 76.175.229.190 - corpsdi3 "GET /login/?login_only=1&user=corpsdi3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdi3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.71.137.234
country_id: 6252001
description:
[2026-07-03 08:05:47 +0000] info [cpaneld] 209.71.137.234 - corpsdi7 "GET /login/?login_only=1&user=corpsdi7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsdi7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.246.213.92
country_id: 6252001
description:
[2026-07-03 08:05:09 +0000] info [cpaneld] 96.246.213.92 - corpsd "GET /login/?login_only=1&user=corpsd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user corpsd (has_cpuser_file failed)


