# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.201
country_id: 1880251
description:
47.128.120.201 - - [03/Jul/2026:17:24:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050137&pdata=https%253A%252F%252Fdagl.tg%252Fcommuniques%252F5-avis-aux-architectes-paiement-en-ligne-des-frais-dinstruction-du-permis-de-construire&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783099494 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/communiques/5-avis-aux-architectes-paiement-en-ligne-des-frais-dinstruction-du-permis-de-construire" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.147.87.175
country_id: 1168579
description:
[2026-07-03 17:24:29 +0000] info [cpaneld] 103.147.87.175 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.84.22.217
country_id: 3469034
description:
[2026-07-03 17:24:43 +0000] info [cpaneld] 170.84.22.217 - pn "GET /login/?login_only=1&user=pn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.216.105.168
country_id: 6252001
description:
[2026-07-03 17:24:55 +0000] info [cpaneld] 217.216.105.168 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.123.212.60
country_id: 3865483
description:
[2026-07-03 17:26:01 +0000] info [cpaneld] 186.123.212.60 - con "GET /login/?login_only=1&user=con&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user con (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.7.211.11
country_id: 3865483
description:
[2026-07-03 17:25:28 +0000] info [cpaneld] 45.7.211.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.118.182.84
country_id: 3625428
description:
92.118.182.84 - - [03/Jul/2026:17:25:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105126&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fatai%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783099542 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/tag/atai/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.118.182.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.114.1
country_id: 3469034
description:
[2026-07-03 17:25:45 +0000] info [cpaneld] 45.162.114.1 - confort "GET /login/?login_only=1&user=confort&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confort (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.187.74.97
country_id: 3017382
description:
37.187.74.97 - newistm [03/Jul/2026:17:25:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672293&pdata=https%253A%252F%252Fnew.istm.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783099549 HTTP/2.0" 302 0 new.istm.tg "https://new.istm.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.187.74.97


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.62.210.3
country_id: 3865483
description:
[2026-07-03 17:25:51 +0000] info [cpaneld] 179.62.210.3 - confor "GET /login/?login_only=1&user=confor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.98.73.59
country_id: 290557
description:
[2026-07-03 17:25:57 +0000] info [cpaneld] 92.98.73.59 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.110.90.19
country_id: 3686110
description:
[2026-07-03 17:26:05 +0000] info [cpaneld] 191.110.90.19 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.213.91
country_id: 3895114
description:
[2026-07-03 17:27:25 +0000] info [cpaneld] 181.43.213.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.8.199
country_id: 3932488
description:
[2026-07-03 17:27:27 +0000] info [cpaneld] 179.6.8.199 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.96.221.254
country_id: 2589581
description:
[2026-07-03 17:27:35 +0000] info [cpaneld] 41.96.221.254 - lasn "GET /login/?login_only=1&user=lasn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.160.42.205
country_id: 3469034
description:
[2026-07-03 17:27:39 +0000] info [cpaneld] 179.160.42.205 - las "GET /login/?login_only=1&user=las&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user las (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.213.80.32
country_id: 2017370
description:
[2026-07-03 17:27:38 +0000] info [cpaneld] 176.213.80.32 - las "GET /login/?login_only=1&user=las&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user las (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.116.25
country_id: 2542007
description:
[2026-07-03 17:27:33 +0000] info [cpaneld] 196.117.116.25 - lasnbtg "GET /login/?login_only=1&user=lasnbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:28:32 +0000] info [webmaild] 196.171.46.177 - gilbert.kakabiti@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user gilbert.kakabiti@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.60.189.252
country_id: 3658394
description:
179.60.189.252 - - [03/Jul/2026:17:30:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853480&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-375448witems%252Fetidm32ic.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783099810 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-375448witems/etidm32ic.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.60.189.252


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.109
country_id: 1814991
description:
27.115.124.109 - - [03/Jul/2026:17:30:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896618&pdata=https%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783099813 HTTP/2.0" 302 0 sodigaz.tg "https://sodigaz.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.68.172.35
country_id: 2635167
description:
[2026-07-03 17:30:50 +0000] info [cpaneld] 138.68.172.35 - tps "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tps (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 3.144.69.63
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-31.3.144.69.63||RSV:8.24||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.77.43
country_id: 6252001
description:
[2026-07-03 17:31:47 +0000] info [cpaneld] 134.199.77.43 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.189.17.83
country_id: 3895114
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/the-basics- fashion-supply- chain-structures/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.200.85
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/24.jpeg HTTP/1.1||RSV:8.24||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.164
country_id: 1880251
description:
47.128.120.164 - - [03/Jul/2026:17:36:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880475&pdata=https%253A%252F%252Fdagl.tg%252Faccueil%252F1-presentation&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783100204 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/accueil/1-presentation" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.164


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 17:37:54 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 196.171.46.177 (Togo:TG)”


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.119.41.206
country_id: 294640
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.24||T:APACHE||RA:212.119.41.206||TA:212.119.41.206||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:37:53 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user sandra.amana@togointerim.net) has locked out IP 196.171.46.177


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 196.171.46.177
country_id: 2363686
description:
Login Blocked: IP reached maximum auth failures [Service]=[webmaild] [Local IP Address]=[154.70.82.246] [Local Port]=[2096] [Remote IP Address]=[196.171.46.177] [Remote Port]=[59638] [Authentication Database]=[mail] [Username]=[sandra.amana@togointerim.net] (5/5 failures) (blocked until [Fri Jul  3 17:52:52 2026 UTC/Fri Jul  3 17:52:52 2026 LOCAL])


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.173.209.105
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.24||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:38:04 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user sandra.amana@togointerim.net) has locked out IP 196.171.46.177


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.218.237.94
country_id: 357994
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/journee-mondiale-des-oceans-kokou-edem-tengue-rappelle-aux-acteurs-la-place-cruciale-des-oceans-dans-le-developpement-economique/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.211.102.117
country_id: 3686110
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/2 HTTP/1.1||RSV:8.24||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.218.237.94
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/journee-mondiale-des-oceans-kokou-edem-tengue-rappelle-aux-acteurs-la-place-cruciale-des-oceans-dans-le-developpement-economique/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.164.91.175
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.24||T:APACHE||RA:141.164.91.175||TA:141.164.91.175||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.152.217
country_id: 2363686
description:
102.64.152.217 - - [03/Jul/2026:17:42:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7377817&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F07%252F03%252Fdiplomatie-lome-accueille-la-conference-ministerielle-extraordinaire-de-lalliance-politique-africaine%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783100542 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/07/03/diplomatie-lome-accueille-la-conference-ministerielle-extraordinaire-de-lalliance-politique-africaine/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.152.217


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.139.191
country_id: 2077456
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.24||T:APACHE||RA:92.113.139.191||TA:92.113.139.191||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.93
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/pizzavi/boissons/jus-de-fruits/?add-to-cart=2037||QS:add-to-cart=2037||RSV:8.24||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.48.114
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.24||T:APACHE||RA:104.253.48.114||TA:104.253.48.114||


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:45:35 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:45:13 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [03/Jul/2026:17:45:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987217&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252Fcpsess7986872734%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_caps%253Dpdf%25253D1%25252Cflash%25253D0%25252Ctiff%25253D0%25252Cwebp%25253D1%25252Cpgpmime%25253D0%2526_uid%253D11522%2526_mbox%253DINBOX%2526_framed%253D1%2526_action%253Dpreview&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783100752 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/cpsess7986872734/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=11522&_mbox=INBOX&_framed=1&_action=preview" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:46:09 +0000] info [webmaild] 196.171.46.177 - mawide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user mawide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:47:55 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.36.223
country_id: 1643084
description:
[2026-07-03 17:47:07 +0000] info [cpaneld] 182.9.36.223 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:47:10 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.36.223
country_id: 1643084
description:
[2026-07-03 17:48:32 +0000] info [cpaneld] 182.9.36.223 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.149.180
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-la-revolution-digitale-au-service-de-la-proximite/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.149.180
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-revolution-digitale-au-service-de-la-proximite/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [03/Jul/2026:17:49:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196075&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783100957 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:49:43 +0000] info [webmaild] 196.171.46.177 - contact@its.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user contact@its.tg) has locked out IP 196.171.46.177


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:49:58 +0000] info [webmaild] 196.171.46.177 - contact@its.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user contact@its.tg) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:50:04 +0000] info [webmaild] 196.171.46.177 - contact@its.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user contact@its.tg) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.36.223
country_id: 1643084
description:
[2026-07-03 17:50:21 +0000] info [cpaneld] 182.9.36.223 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.175.236
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/shop/bouffe/pizzavi/pizza-pizzavi/juanita/?add-to-cart=2009||QS:add-to-cart=2009||RSV:8.24||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - richard.attiogbe@togointerim.net [07/03/2026:17:51:12 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: richard.attiogbe@togointerim.net


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le couperet est tomb\xc3\xa9 sans surprise. quelques jours apr\xc3\xa8s la nouvelle d\xc3\xa9sillusion de l\xe2\x80\x99allemagne en coupe du monde 2026, \xc3\xa9limin\xc3\xa9e d\xc3\xa8s les seizi\xc3\xa8mes de finale, julian nagelsmann a officiellement quitt\xc3\xa9 son poste de s\xc3\xa9lectionneur.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le jeune technicien de 38 ans, pourtant porteur d\xe2\x80\x99un projet de reconstruction, n\xe2\x80\x99a pas r\xc3\xa9sist\xc3\xa9 \xc3\xa0 une troisi\xc3\xa8me \xc3\xa9limination pr\xc3\xa9coce cons\xc3\xa9cutive d\xe2\x80\x99une mannschaft en perte d\xe2\x80\x99identit\xc3\xa9. face au paraguay, les allemands ont encore chut\xc3\xa9, scellant une crise sportive devenue structurelle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>klopp, le nom qui s\xe2\x80\x99impose pour un nouveau d\xc3\xa9part</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans la foul\xc3\xa9e de ce nouvel \xc3\xa9chec, la f\xc3\xa9d\xc3\xa9ration allemande de football (dfb) a rapidement activ\xc3\xa9 son plan de relance. et un nom s\xe2\x80\x99est impos\xc3\xa9 avec insistance : j\xc3\xbcrgen klopp.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31769,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/07/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31769\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99ancien entra\xc3\xaeneur de liverpool, aujourd\xe2\x80\x99hui directeur du football chez red bull, est d\xc3\xa9sormais en discussions avanc\xc3\xa9es avec la f\xc3\xa9d\xc3\xa9ration. selon la dfb, klopp s\xe2\x80\x99est montr\xc3\xa9 <em>\xc2\xab pr\xc3\xaat, en principe, \xc3\xa0 prendre ce poste \xc2\xbb,</em> ouvrant la voie \xc3\xa0 un possible retour sur un banc de touche de tr\xc3\xa8s haut niveau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>une mission presque impossible : reconstruire une g\xc3\xa9ante fragilis\xc3\xa9e</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>si l\xe2\x80\x99option klopp se confirme, le d\xc3\xa9fi sera colossal. l\xe2\x80\x99allemagne, quadruple championne du monde, n\xe2\x80\x99a plus atteint les quarts de finale depuis plusieurs \xc3\xa9ditions et encha\xc3\xaene les d\xc3\xa9sillusions depuis 2018.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99objectif est clair : restaurer une identit\xc3\xa9 de jeu, redonner de la stabilit\xc3\xa9 et surtout r\xc3\xa9installer la mannschaft parmi les puissances dominantes du football mondial.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>klopp incarne justement ce profil : \xc3\xa9nergie, leadership, capacit\xc3\xa9 \xc3\xa0 transformer des groupes en machines comp\xc3\xa9titives. mais m\xc3\xaame pour lui, la mission s\xe2\x80\x99annonce comme l\xe2\x80\x99une des plus difficiles de sa carri\xc3\xa8re.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>une transition sous pression maximale</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la dfb veut aller vite. les prochaines \xc3\xa9ch\xc3\xa9ances internationales, notamment en ligue des nations, serviront de premier test grandeur nature pour le futur s\xc3\xa9lectionneur.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"width\":\"535px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\" style=\"width:535px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>en interne, le message est clair : il ne s\xe2\x80\x99agit plus seulement de reconstruire, mais de survivre \xc3\xa0 une crise qui dure depuis trois tournois majeurs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99allemagne entre dans une nouvelle \xc3\xa8re. et si j\xc3\xbcrgen klopp venait \xc3\xa0 en prendre les commandes, ce ne serait pas seulement un changement d\xe2\x80\x99entra\xc3\xaeneur\xe2\x80\xa6 mais peut-\xc3\xaatre le d\xc3\xa9but d\xe2\x80\x99une refondation totale du football allemand.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>msn</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.24||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 80.94.95.202
country_id: 798549
domain: mesyscom.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:17-52.80.94.95.202||RSV:8.24||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.77.112.172
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 51.77.112.172: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [03/Jul/2026:17:53:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984855&pdata=https%253A%252F%252Fwebmail.togointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783101237 HTTP/2.0" 302 0 webmail.togointerim.net "https://webmail.togointerim.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 17:54:25 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 196.171.46.177 (Togo:TG)”


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:54:50 +0000] info [webmaild] 196.171.46.177 - mawide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user mawide@togointerim.net) has locked out IP 196.171.46.177


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 196.171.46.177
country_id: 2363686
description:
Login Blocked: IP reached maximum auth failures [Service]=[webmaild] [Local IP Address]=[127.0.0.1] [Local Port]=[443] [Remote IP Address]=[196.171.46.177] [Remote Port]=[34992] [Authentication Database]=[mail] [Username]=[matthieu.awide@togointerim.net] (6/5 failures) (blocked until [Fri Jul  3 18:09:21 2026 UTC/Fri Jul  3 18:09:21 2026 LOCAL])


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:54:43 +0000] info [webmaild] 196.171.46.177 - mawide@togointerim.net "GET /cpsess4010552448/3rdparty/roundcube/?_task=logout&_token=thXe1Tqf3U8ruv55siRnS3y3jMRitNCV HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [127.0.0.1] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:54:21 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.143.12.163
country_id: 2542007
description:
[2026-07-03 17:55:55 +0000] info [cpaneld] 41.143.12.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.247.193.80
country_id: 3469034
description:
[2026-07-03 17:56:00 +0000] info [cpaneld] 170.247.193.80 - droitshumains "GET /login/?login_only=1&user=droitshumains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.222.167.72
country_id: 1522867
description:
[2026-07-03 17:56:03 +0000] info [cpaneld] 176.222.167.72 - droitshumainstg "GET /login/?login_only=1&user=droitshumainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumainstg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.8.47.128
country_id: 3469034
domain: www.wellcity.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wellcity.tg/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.249.105
country_id: 1562822
description:
[2026-07-03 17:56:18 +0000] info [cpaneld] 14.191.249.105 - droit "GET /login/?login_only=1&user=droit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.158.76
country_id: 285570
description:
[2026-07-03 17:56:11 +0000] info [cpaneld] 37.231.158.76 - droitsh "GET /login/?login_only=1&user=droitsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.172.225.203
country_id: 3017382
description:
[2026-07-03 17:56:20 +0000] info [cpaneld] 88.172.225.203 - droi "GET /login/?login_only=1&user=droi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.139.237.59
country_id: 2017370
description:
[2026-07-03 17:56:23 +0000] info [cpaneld] 95.139.237.59 - dro "GET /login/?login_only=1&user=dro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.183.124.229
country_id: 3996063
description:
[2026-07-03 17:56:27 +0000] info [cpaneld] 189.183.124.229 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.80.166.86
country_id: 3175395
description:
45.80.166.86 - - [03/Jul/2026:17:59:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236251&pdata=https%253A%252F%252Ftogomedia24.tg%252F2021%252F02%252F16%252Ftogo-maryse-quashie-sadresse-aux-professionnels-de-la-presse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783101593 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2021/02/16/togo-maryse-quashie-sadresse-aux-professionnels-de-la-presse/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6443.1818 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.80.166.86


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [03/Jul/2026:17:59:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6922182&pdata=https%253A%252F%252Fwebmail.togointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783101559 HTTP/2.0" 302 0 webmail.togointerim.net "https://webmail.togointerim.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:59:23 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 17:59:30 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:01:38 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.139.160
country_id: 2363686
description:
[2026-07-03 18:01:52 +0000] info [webmaild] 196.168.139.160 - chef.dgi@ucao-uut.tg "POST /cpsess2980363719/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:02:24 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 2501
name: User authentication failure.
description:
185.132.134.104 - &ktMEDemXbX!nw$4 [07/03/2026:18:02:21 -0000] "PROPFIND" FAILED LOGIN cpdavd: Could not fetch system home directory for &ktMEDemXbX!nw$4


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.139.160
country_id: 2363686
description:
[2026-07-03 18:02:25 +0000] info [webmaild] 196.168.139.160 - chef.dgi@ucao-uut.tg "GET /cpsess4624478941/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:02:25 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.139.160
country_id: 2363686
description:
[2026-07-03 18:03:52 +0000] info [webmaild] 196.168.139.160 - secretariat.esi@ucao-uut.tg "POST /cpsess2989899999/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.139.160
country_id: 2363686
description:
[2026-07-03 18:04:52 +0000] info [webmaild] 196.168.139.160 - secretariat.esi@ucao-uut.tg "POST /cpsess2989899999/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.139.160
country_id: 2363686
description:
[2026-07-03 18:05:52 +0000] info [webmaild] 196.168.139.160 - secretariat.esi@ucao-uut.tg "POST /cpsess9336476263/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:05:06 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:08:35 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.192.137.37
country_id: 6252001
domain: www.kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.24||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.147.134
country_id: 1562822
domain: www.brmn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tg/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [03/Jul/2026:18:14:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857731&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252Fcpsess5788731015%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783102439 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/cpsess5788731015/3rdparty/roundcube/?_task=mail&_mbox=INBOX" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: matwtogo.org
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var lfqg=arguments[0x1];var qlhkm=lfqg;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 196.171.46.177
country_id: 2363686
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Local Port]=[993] [Remote IP Address]=[196.171.46.177] [Remote Port]=[39904] [Authentication Database]=[mail] [Username]=[xhadzi@togointerim.net] (6/5 failures) (blocked until [Fri Jul  3 18:29:01 2026 UTC/Fri Jul  3 18:29:01 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.78.206.47
country_id: 2264397
description:
[2026-07-03 18:13:49 +0000] info [cpaneld] 176.78.206.47 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.150.99.46
country_id: 690791
description:
[2026-07-03 18:14:02 +0000] info [cpaneld] 46.150.99.46 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.39.37.70
country_id: 953987
domain: www.brmn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.brmn.tghttp/www.brmn.tg/ HTTP/1.1||RSV:8.24||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 171.22.251.198
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.24||T:APACHE||RA:171.22.251.198||TA:171.22.251.198||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.74.156
country_id: 3865483
description:
[2026-07-03 18:13:52 +0000] info [cpaneld] 148.227.74.156 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.239.103.105
country_id: 3469034
description:
[2026-07-03 18:13:57 +0000] info [cpaneld] 45.239.103.105 - metaarttg "GET /login/?login_only=1&user=metaarttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaarttg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.55.195.72
country_id: 3469034
description:
[2026-07-03 18:13:36 +0000] info [cpaneld] 177.55.195.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.27.132.96
country_id: 1562822
description:
[2026-07-03 18:13:56 +0000] info [cpaneld] 123.27.132.96 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 18:14:04 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 196.171.46.177 (Togo:TG)”


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [03/Jul/2026:18:14:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001833&pdata=http%253A%252F%252Fwebdisk.net.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783102476 HTTP/1.1" 302 0 webdisk.net.free.netmaster.tg "http://webdisk.net.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.166.102.34
country_id: 3017382
description:
[2026-07-03 18:14:07 +0000] info [cpaneld] 88.166.102.34 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.233.214.65
country_id: 2017370
description:
[2026-07-03 18:14:12 +0000] info [cpaneld] 46.233.214.65 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:14:38 +0000] info [cpaneld] 196.171.46.177 - togoinrdceh "POST /cpsess2945292715/execute/Email/list_pops_with_disk HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [127.0.0.1] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:14:39 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.51.224
country_id: 1880251
domain: bawasongroup.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.69.146.117
country_id: 1269750
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.25||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:15:13 +0000] info [webmaild] 196.171.46.177 - jean.wanta@togointerim.net "POST /cpsess8100619284/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [127.0.0.1] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:15:40 +0000] info [webmaild] 196.171.46.177 - xolali.hadzi@togointerim.net "POST /cpsess4357314924/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user xolali.hadzi@togointerim.net) has locked out IP 196.171.46.177


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.71.44.117
country_id: 6252001
domain: www.lasnbtogo.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.56.166.50
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/72.jpeg HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [03/Jul/2026:18:16:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907548&pdata=https%253A%252F%252Fautoconfig.net.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783102610 HTTP/2.0" 302 0 autoconfig.net.free.netmaster.tg "https://autoconfig.net.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [03/Jul/2026:18:18:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922663&pdata=http%253A%252F%252Fcpcontacts.net.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783102700 HTTP/1.1" 302 0 cpcontacts.net.free.netmaster.tg "http://cpcontacts.net.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.103.135.253
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/visite-du-ministre-allemand-de-la-cooperation-economique-et-du-developpement HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [03/Jul/2026:18:18:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802865&pdata=http%253A%252F%252Fcpanel.net.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783102697 HTTP/1.1" 302 0 cpanel.net.free.netmaster.tg "http://cpanel.net.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:19:29 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user sandra.amana@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:19:20 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user sandra.amana@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [03/Jul/2026:18:20:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737927&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252Fcpsess2869812510%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_caps%253Dpdf%25253D1%25252Cflash%25253D0%25252Ctiff%25253D0%25252Cwebp%25253D1%25252Cpgpmime%25253D0%2526_uid%253D340%2526_mbox%253DINBOX.Sent%2526_framed%253D1%2526_action%253Dpreview&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783102800 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/cpsess2869812510/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=340&_mbox=INBOX.Sent&_framed=1&_action=preview" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:21:06 +0000] info [webmaild] 196.171.46.177 - justine.botcholi@togointerim.net "POST /cpsess2869812510/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [127.0.0.1] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.105
country_id: 2750405
description:
192.42.116.105 - ruuwezvf [03/Jul/2026:18:21:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937322&pdata=https%253A%252F%252Fmafisteel.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783102875 HTTP/2.0" 302 0 mafisteel.tg "https://mafisteel.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:23:47 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-07-03 18:24:35 +0000] info [webmaild] 196.170.45.140 - gtondja@wages.tg "GET /cPanel_magic_revision_1726168745/webmail/jupiter/_assets/js/master-legacy.cmb.min.js HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.186.208.93
country_id: 3625428
description:
[2026-07-03 18:25:02 +0000] info [cpaneld] 45.186.208.93 - leadelles "GET /login/?login_only=1&user=leadelles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.37.43
country_id: 3469034
description:
[2026-07-03 18:25:15 +0000] info [cpaneld] 170.238.37.43 - leadell "GET /login/?login_only=1&user=leadell&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadell (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.66.152.231
country_id: 3932488
description:
[2026-07-03 18:25:09 +0000] info [cpaneld] 181.66.152.231 - leadelle "GET /login/?login_only=1&user=leadelle&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadelle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.133.35.80
country_id: 2264397
description:
[2026-07-03 18:25:18 +0000] info [cpaneld] 94.133.35.80 - sma "GET /login/?login_only=1&user=sma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.48.53.92
country_id: 3932488
description:
[2026-07-03 18:25:27 +0000] info [cpaneld] 179.48.53.92 - lea "GET /login/?login_only=1&user=lea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.236.226.172
country_id: 298795
description:
[2026-07-03 18:25:30 +0000] info [cpaneld] 176.236.226.172 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.104.129.68
country_id: 6252001
description:
[2026-07-03 18:25:05 +0000] info [cpaneld] 73.104.129.68 - smarty "GET /login/?login_only=1&user=smarty&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smarty (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.34.21.7
country_id: 6252001
description:
[2026-07-03 18:25:17 +0000] info [cpaneld] 100.34.21.7 - leadel "GET /login/?login_only=1&user=leadel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leadel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.49.249.234
country_id: 290557
description:
[2026-07-03 18:25:25 +0000] info [cpaneld] 2.49.249.234 - lead "GET /login/?login_only=1&user=lead&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lead (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:25:42 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user sandra.amana@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:27:12 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:27:14 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user kekeli.alemawo@togointerim.net) has locked out IP 196.171.46.177


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.231.65.136
country_id: 6252001
domain: www.lct-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:28:39 +0000] info [webmaild] 196.171.46.177 - vincent.sodjehoun@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user vincent.sodjehoun@togointerim.net) has locked out IP 196.171.46.177


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 196.171.46.177
country_id: 2363686
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Local Port]=[993] [Remote IP Address]=[196.171.46.177] [Remote Port]=[53477] [Authentication Database]=[mail] [Username]=[billy.kouevi@togointerim.net] (5/5 failures) (blocked until [Fri Jul  3 18:49:07 2026 UTC/Fri Jul  3 18:49:07 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.83.65.156
country_id: 3865483
description:
[2026-07-03 18:34:35 +0000] info [cpaneld] 190.83.65.156 - istm "GET /login/?login_only=1&user=istm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.132.49.69
country_id: 2017370
description:
[2026-07-03 18:34:46 +0000] info [cpaneld] 45.132.49.69 - is "GET /login/?login_only=1&user=is&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user is (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.50.175.122
country_id: 102358
description:
[2026-07-03 18:34:29 +0000] info [cpaneld] 188.50.175.122 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 18:34:15 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 196.171.46.177 (Togo:TG)”


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: haplucia-togo.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:35:26 +0000] info [webmaild] 196.171.46.177 - vincent.sodjehoun@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user vincent.sodjehoun@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-07-03 18:35:07 dovecot_login authenticator failed for H=(JURISTE01) [196.171.46.177]:53480: 535 Incorrect authentication data (set_id=billy.kouevi@togointerim.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.182.150.60
country_id: 3469034
description:
[2026-07-03 18:40:28 +0000] info [cpaneld] 45.182.150.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.171.161
country_id: 290557
description:
[2026-07-03 18:40:31 +0000] info [cpaneld] 5.107.171.161 - nps "GET /login/?login_only=1&user=nps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nps (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.229
country_id: 3865483
description:
[2026-07-03 18:40:37 +0000] info [cpaneld] 181.46.164.229 - npstg "GET /login/?login_only=1&user=npstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user npstg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.217.17.135
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/07/images-1-300x169.webp HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.231.246.143
country_id: 3469034
description:
[2026-07-03 18:40:41 +0000] info [cpaneld] 170.231.246.143 - np "GET /login/?login_only=1&user=np&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user np (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-03 18:41:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:31994: 535 Incorrect authentication data (set_id=rpcuser)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 45.136.26.117
country_id: 6252001
domain: www.cameg-togo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.25||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.166.203
country_id: 6252001
description:
[2026-07-03 18:44:52 +0000] info [cpaneld] 136.227.166.203 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.144.43.145
country_id: 6252001
description:
2026-07-03 18:45:22 dovecot_plain authenticator failed for H=(5ogvbpbje05s80vzq) [136.144.43.145]:48835: 535 Incorrect authentication data (set_id=development@confortis.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-03 18:45:38 +0000] info [whostmgrd] 77.68.84.233 - root "GET /cpsess4765218958/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-03 18:45:37 +0000] info [whostmgrd] 77.68.84.233 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [03/Jul/2026:18:46:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169135&pdata=https%253A%252F%252Fwww.dagl.tg%252Fcommunes%252F12-commune-du-golfe-4&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104388 HTTP/2.0" 302 0 www.dagl.tg "https://www.dagl.tg/communes/12-commune-du-golfe-4" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.93.136
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:142.111.93.136||TA:142.111.93.136||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.16.78.89
country_id: 2510769
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/author/fbafrica/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.115.208
country_id: 2363686
description:
[2026-07-03 18:47:26 +0000] info [webmaild] 196.168.115.208 - guillaume.saguintaah@togointerim.net "POST /cpsess0751701256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.195.214] != Current IP Address [196.168.115.208]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.50
country_id: 1814991
description:
123.6.49.50 - - [03/Jul/2026:18:47:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6342766&pdata=https%253A%252F%252Fwww.dagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104469 HTTP/2.0" 302 0 www.dagl.tg "https://www.dagl.tg/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:48:26 +0000] info [cpaneld] 196.171.46.177 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user togoinrdceh) has locked out IP 196.171.46.177


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-07-03 18:48:53 +0000] info [webmaild] 196.168.0.186 - gtondja@wages.tg "GET /cPanel_magic_revision_1726168667/webmail/jupiter/styles/fonts.min.css HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 18:49:08 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 196.171.46.177 (Togo:TG)”


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.118.160.13
country_id: 1814991
description:
2026-07-03 18:49:57 dovecot_login authenticator failed for H=(konyqx) [106.118.160.13]:4257: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:49:25 +0000] info [cpaneld] 196.171.46.177 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user togoinrdceh) has locked out IP 196.171.46.177


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 196.171.46.177
country_id: 2363686
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Local Port]=[993] [Remote IP Address]=[196.171.46.177] [Remote Port]=[40094] [Authentication Database]=[mail] [Username]=[xhadzi@togointerim.net] (5/5 failures) (blocked until [Fri Jul  3 19:04:07 2026 UTC/Fri Jul  3 19:04:07 2026 LOCAL])


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [03/Jul/2026:18:50:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6975892&pdata=http%253A%252F%252Fwebdisk.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104610 HTTP/1.1" 302 0 webdisk.test.free.netmaster.tg "http://webdisk.test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [03/Jul/2026:18:50:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249261&pdata=https%253A%252F%252Fwebmail.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104612 HTTP/2.0" 302 0 webmail.test.free.netmaster.tg "https://webmail.test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.118.160.13
country_id: 1814991
description:
2026-07-03 18:50:22 dovecot_login authenticator failed for H=(iqoeh) [106.118.160.13]:4933: 535 Incorrect authentication data (set_id=it@cafe.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.180.213
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/restaurant/opera/snack/?add-to-cart=3563||QS:add-to-cart=3563||RSV:8.25||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [03/Jul/2026:18:50:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933928&pdata=http%253A%252F%252Ftest.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104608 HTTP/1.1" 302 0 test.free.netmaster.tg "http://test.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.244.158.141
country_id: 1522867
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.139.243.240
country_id: 2017370
description:
[2026-07-03 18:51:53 +0000] info [cpaneld] 79.139.243.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.180.252
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/sports-equipment/?add-to-cart=154||QS:add-to-cart=154||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.117.248.9
country_id: 2017370
description:
[2026-07-03 18:52:02 +0000] info [cpaneld] 217.117.248.9 - nstreamprocom "GET /login/?login_only=1&user=nstreamprocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamprocom (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.62.176
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:172.245.62.176||TA:172.245.62.176||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:51:57 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-03 18:51:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:64349: 535 Incorrect authentication data (set_id=zakupki)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.61.184.236
country_id: 3469034
description:
[2026-07-03 18:52:36 +0000] info [cpaneld] 187.61.184.236 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.64.163.28
country_id: 1282988
description:
[2026-07-03 18:52:52 +0000] info [cpaneld] 45.64.163.28 - butodr "GET /login/?login_only=1&user=butodr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user butodr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.141.224.53
country_id: 2017370
description:
[2026-07-03 18:52:56 +0000] info [cpaneld] 178.141.224.53 - butod "GET /login/?login_only=1&user=butod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user butod (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.115.208
country_id: 2363686
description:
[2026-07-03 18:52:26 +0000] info [webmaild] 196.168.115.208 - guillaume.saguintaah@togointerim.net "POST /cpsess0751701256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.184.132
country_id: 3437598
description:
[2026-07-03 18:52:41 +0000] info [cpaneld] 186.12.184.132 - butodra "GET /login/?login_only=1&user=butodra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user butodra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.213.110
country_id: 1733045
description:
[2026-07-03 18:53:02 +0000] info [cpaneld] 113.211.213.110 - buto "GET /login/?login_only=1&user=buto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user buto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:52:33 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user kekeli.alemawo@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [03/Jul/2026:18:53:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132167&pdata=https%253A%252F%252Ftest.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104793 HTTP/2.0" 302 0 test.free.netmaster.tg "https://test.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.115.208
country_id: 2363686
description:
[2026-07-03 18:53:57 +0000] info [webmaild] 196.168.115.208 - guillaume.saguintaah@togointerim.net "POST /cpsess0751701256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.146.223
country_id: 99237
description:
[2026-07-03 18:53:08 +0000] info [cpaneld] 5.175.146.223 - but "GET /login/?login_only=1&user=but&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user but (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.4.201.229
country_id: 1605651
description:
[2026-07-03 18:53:13 +0000] info [cpaneld] 1.4.201.229 - bu "GET /login/?login_only=1&user=bu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 18:53:07 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user matthieu.awide@togointerim.net) has locked out IP 196.171.46.177


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 176.76.131.198
country_id: 3190538
description:
176.76.131.198 - - [03/Jul/2026:18:54:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619862&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2087&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104879 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.76.131.198


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.132.90
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/reunion-distributeurs HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.115.208
country_id: 2363686
description:
[2026-07-03 18:54:26 +0000] info [webmaild] 196.168.115.208 - guillaume.saguintaah@togointerim.net "POST /cpsess0751701256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.191.101.85
country_id: 3895114
description:
45.191.101.85 - - [03/Jul/2026:18:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923737&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-54451vetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783104935 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-54451vetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.191.101.85


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.115.250
country_id: 1562822
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/scoring.php HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-03 18:57:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:15657: 535 Incorrect authentication data (set_id=zhangyi)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.70
country_id: 1814991
description:
27.115.124.70 - - [03/Jul/2026:18:58:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13093476&pdata=https%253A%252F%252Fwww.dagl.tg%252Faccueil%252F11-cabinet-du-gouverneur&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783105137 HTTP/2.0" 302 0 www.dagl.tg "https://www.dagl.tg/accueil/11-cabinet-du-gouverneur" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-03 18:59:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:12870: 535 Incorrect authentication data (set_id=zhangyi)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.115.208
country_id: 2363686
description:
[2026-07-03 18:59:26 +0000] info [webmaild] 196.168.115.208 - guillaume.saguintaah@togointerim.net "POST /cpsess0751701256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.0.248
country_id: 6252001
domain: marque.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/marque.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.138.173.54
country_id: 1210997
description:
[2026-07-03 19:00:17 +0000] info [cpaneld] 103.138.173.54 - mftogotg "GET /login/?login_only=1&user=mftogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.182.240
country_id: 1282988
description:
[2026-07-03 19:00:21 +0000] info [cpaneld] 103.163.182.240 - mftog "GET /login/?login_only=1&user=mftog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.165.115.167
country_id: 1562822
description:
14.165.115.167 - - [03/Jul/2026:19:00:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13264839&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-190810kitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783105249 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-190810kitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.165.115.167


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.115.208
country_id: 2363686
description:
[2026-07-03 19:00:27 +0000] info [webmaild] 196.168.115.208 - guillaume.saguintaah@togointerim.net "POST /cpsess0751701256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.140.243.68
country_id: 3469034
description:
[2026-07-03 19:00:34 +0000] info [cpaneld] 177.140.243.68 - mf "GET /login/?login_only=1&user=mf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.145.212.175
country_id: 3469034
description:
[2026-07-03 19:00:05 +0000] info [cpaneld] 192.145.212.175 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.9.210.72
country_id: 1282988
description:
[2026-07-03 19:00:32 +0000] info [cpaneld] 203.9.210.72 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.115.208
country_id: 2363686
description:
[2026-07-03 19:01:26 +0000] info [webmaild] 196.168.115.208 - guillaume.saguintaah@togointerim.net "POST /cpsess0751701256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-03 19:02:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:15357: 535 Incorrect authentication data (set_id=cms2)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.55.191
country_id: 3469034
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/formations.php HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [03/Jul/2026:19:02:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249835&pdata=http%253A%252F%252Fcpanel.test.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783105358 HTTP/1.1" 302 0 cpanel.test.free.netmaster.tg "http://cpanel.test.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 19:04:31 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 196.171.46.177 (Togo:TG)”


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.14
country_id: 2750405
description:
192.42.116.14 - ebbmnmtd [03/Jul/2026:19:04:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736793&pdata=https%253A%252F%252Fmetaart.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783105485 HTTP/2.0" 302 0 metaart.tg "https://metaart.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.14


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.93.72.185
country_id: 1819730
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/images/other/image-school-begin.jpg HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-07-03 19:04:53 dovecot_login authenticator failed for H=(nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:50049: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-07-03 19:04:34 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:56622: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 196.171.46.177
country_id: 2363686
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[154.70.82.246] [Local Port]=[993] [Remote IP Address]=[196.171.46.177] [Remote Port]=[41342] [Authentication Database]=[mail] [Username]=[contact@its.tg] (7/5 failures) (blocked until [Fri Jul  3 19:19:26 2026 UTC/Fri Jul  3 19:19:26 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-07-03 19:05:25 dovecot_login authenticator failed for H=(nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:52398: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.74.69
country_id: 2635167
description:
[2026-07-03 19:05:09 +0000] info [cpaneld] 81.171.74.69 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-03 19:07:13 +0000] info [webmaild] 196.171.46.177 - direction@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: brute force attempt (user direction@togointerim.net) has locked out IP 196.171.46.177


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.169.64.212
country_id: 1168579
domain: www.mediatopnews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mediatopnews.tghttp/www.mediatopnews.tg/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 209.97.178.11
country_id: 2635167
domain: davetechno.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.25||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&who=authors&_fields=id,slug||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.90.183.200
country_id: 6252001
description:
[2026-07-03 19:08:49 +0000] info [cpaneld] 72.90.183.200 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.60.121.106
country_id: 6252001
description:
[2026-07-03 19:08:46 +0000] info [cpaneld] 24.60.121.106 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.213.126.10
country_id: 6252001
description:
[2026-07-03 19:08:54 +0000] info [cpaneld] 73.213.126.10 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.120.164
country_id: 1880251
description:
47.128.120.164 - - [03/Jul/2026:19:08:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131611&pdata=https%253A%252F%252Fdagl.tg%252Fcommunes%252F12-commune-du-golfe-4&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783105735 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/communes/12-commune-du-golfe-4" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.120.164


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.81.218
country_id: 6252001
description:
[2026-07-03 19:08:58 +0000] info [cpaneld] 68.7.81.218 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.241.158.117
country_id: 174982
description:
[2026-07-03 19:08:42 +0000] info [cpaneld] 87.241.158.117 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.155.183.77
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-directions-regionales-au-coeur-de-laction-environnementale/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.103.188.114
country_id: 6252001
description:
[2026-07-03 19:09:01 +0000] info [cpaneld] 38.103.188.114 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.166.97.103
country_id: 3625428
description:
[2026-07-03 19:08:39 +0000] info [cpaneld] 38.166.97.103 - snbtg "GET /login/?login_only=1&user=snbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.40.167.117
country_id: 6252001
description:
[2026-07-03 19:09:10 +0000] info [cpaneld] 8.40.167.117 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.115.1.80
country_id: 6252001
description:
[2026-07-03 19:09:07 +0000] info [cpaneld] 24.115.1.80 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.139.232.165
country_id: 2017370
description:
[2026-07-03 19:09:27 +0000] info [cpaneld] 95.139.232.165 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.146.10.132
country_id: 6252001
description:
[2026-07-03 19:09:04 +0000] info [cpaneld] 73.146.10.132 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.133.14.9
country_id: 2017370
description:
[2026-07-03 19:09:17 +0000] info [cpaneld] 91.133.14.9 - sncomtg "GET /login/?login_only=1&user=sncomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncomtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.61.208.238
country_id: 2017370
description:
[2026-07-03 19:09:23 +0000] info [cpaneld] 109.61.208.238 - snc "GET /login/?login_only=1&user=snc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.104.253.161
country_id: 272103
description:
[2026-07-03 19:09:13 +0000] info [cpaneld] 185.104.253.161 - sncom "GET /login/?login_only=1&user=sncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.117.49.88
country_id: 6252001
description:
[2026-07-03 19:09:14 +0000] info [cpaneld] 98.117.49.88 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.152.95.73
country_id: 3996063
description:
[2026-07-03 19:09:20 +0000] info [cpaneld] 201.152.95.73 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 19:10:20 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 81.171.74.69 (United Kingdom:GB)”


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.166.195.24
country_id: 6252001
domain: nps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 81.171.74.69
country_id: 2635167
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[154.70.82.246] [Local Port]=[2083] [Remote IP Address]=[81.171.74.69] [Remote Port]=[61597] [Authentication Database]=[system] [Username]=[BEWELL] (5/5 failures) (blocked until [Fri Jul  3 19:25:16 2026 UTC/Fri Jul  3 19:25:16 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.74.69
country_id: 2635167
description:
[2026-07-03 19:10:16 +0000] info [cpaneld] 81.171.74.69 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.114.172
country_id: 2363686
description:
[2026-07-03 19:12:03 +0000] info [webmaild] 196.168.114.172 - emt@emt.tg "POST /cpsess7357903630/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.29.120] != Current IP Address [196.168.114.172]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.66
country_id: 130758
description:
2026-07-03 19:12:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.66]:16808: 535 Incorrect authentication data (set_id=clif)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.227
country_id: 6252001
description:
[2026-07-03 19:13:19 +0000] info [cpaneld] 64.44.59.227 NEW zxtqbmmj:ptuEeOTsYjtJlLv4 address=64.44.59.227,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.245.180.23
country_id: 241170
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20260629_152746_387-300x117.webp HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.74.69
country_id: 2635167
description:
[2026-07-03 19:13:45 +0000] info [cpaneld] 81.171.74.69 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.228.172.6
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.228.172.6: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.74.69
country_id: 2635167
description:
[2026-07-03 19:17:23 +0000] info [cpaneld] 81.171.74.69 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.165.204
country_id: 783754
description:
2026-07-03 19:18:27 dovecot_plain authenticator failed for H=(v830ypdo6xlds4tcdj82) [103.124.165.204]:40832: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.78.85.92
country_id: 1835841
description:
2026-07-03 19:20:32 dovecot_login authenticator failed for H=([118.145.247.242]) [220.78.85.92]:45831: 535 Incorrect authentication data (set_id=nawoki@otr.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 1.38.139.177
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:32409.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f6f03ef0c5f7b4a1b796b86f35e8040abce51cff||Title:0xfdb76520||RSV:8.25||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 1.38.139.177
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.208.101.123
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.74.69
country_id: 2635167
description:
[2026-07-03 19:24:30 +0000] info [cpaneld] 81.171.74.69 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user ingertgsarl) has locked out IP 81.171.74.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.74.69
country_id: 2635167
description:
[2026-07-03 19:25:36 +0000] info [cpaneld] 81.171.74.69 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.114.11.95
country_id: 3508796
description:
[2026-07-03 19:27:07 +0000] info [cpaneld] 93.114.11.95 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.167.143
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:199.96.167.143||TA:199.96.167.143||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.190.249
country_id: 3658394
description:
[2026-07-03 19:31:36 +0000] info [cpaneld] 157.100.190.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.193.138.166
country_id: 3469034
description:
[2026-07-03 19:31:40 +0000] info [cpaneld] 186.193.138.166 - atms "GET /login/?login_only=1&user=atms&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atms (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.128.145.126
country_id: 3469034
description:
[2026-07-03 19:31:44 +0000] info [cpaneld] 177.128.145.126 - atmstg "GET /login/?login_only=1&user=atmstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atmstg (has_cpuser_file failed)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.235
country_id: 3017382
domain: perfect-labo.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zxtqbmmj/public_html/.941708336759513.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.215
country_id: 2635167
description:
[2026-07-03 19:32:56 +0000] info [cpaneld] 5.230.133.215 NEW zxtqbmmj:0YKf30QuhGSPN6Cv address=5.230.133.215,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.246
country_id: 2635167
description:
[2026-07-03 19:32:57 +0000] info [cpaneld] 5.230.153.246 NEW zxtqbmmj:3xHLW7q6SvJrjLwb address=5.230.153.246,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 165.22.187.91
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:8.25||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 80.251.195.78
country_id: 2661886
description:
Denial of Service (DoS) attack was discovered from 80.251.195.78: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.224.122.48
country_id: 3469034
description:
[2026-07-03 19:37:31 +0000] info [cpaneld] 186.224.122.48 - sococimtg "GET /login/?login_only=1&user=sococimtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococimtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.231.34
country_id: 1562822
description:
[2026-07-03 19:37:38 +0000] info [cpaneld] 14.191.231.34 - sococi "GET /login/?login_only=1&user=sococi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococi (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.136.83
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/djama-panache HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.229.89.101
country_id: 1562822
description:
[2026-07-03 19:37:27 +0000] info [cpaneld] 171.229.89.101 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.106.73.204
country_id: 3469034
description:
[2026-07-03 19:37:47 +0000] info [cpaneld] 179.106.73.204 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.121.171
country_id: 290291
description:
[2026-07-03 19:37:50 +0000] info [cpaneld] 88.201.121.171 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 35.192.232.168
country_id: 6252001
domain: in.crepsad.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: in.crepsad.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"data_516472fe\":false,\"status\":\"resolved_model\",\"reason\":-1,\"_response\":{\"_prefix\":\"var mbir=arguments['\\\\x31'];var xajdl=mbir;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"f\\\",\\\"er\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.32.192.146
country_id: 2017370
description:
[2026-07-03 19:40:01 +0000] info [cpaneld] 212.32.192.146 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.221.192.93
country_id: 3017382
description:
[2026-07-03 19:40:30 +0000] info [cpaneld] 86.221.192.93 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.103.36.241
country_id: 2589581
description:
[2026-07-03 19:40:28 +0000] info [cpaneld] 41.103.36.241 - sod "GET /login/?login_only=1&user=sod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sod (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 203.144.86.61
country_id: 1831722
description:
[2026-07-03 19:41:00 +0000] info [cpaneld] 203.144.86.61 NEW zxtqbmmj:5aoFCPatTjkLxlE4 address=203.144.86.61,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.249.166.53
country_id: 3469034
description:
[2026-07-03 19:40:14 +0000] info [cpaneld] 167.249.166.53 - sodiga "GET /login/?login_only=1&user=sodiga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodiga (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.38.115.245
country_id: 953987
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/lancement-djama-stout-porter HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.122.154.130
country_id: 3437598
description:
[2026-07-03 19:41:27 +0000] info [cpaneld] 181.122.154.130 - soeurndetogo "GET /login/?login_only=1&user=soeurndetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.129.166.224
country_id: 285570
description:
[2026-07-03 19:41:43 +0000] info [cpaneld] 94.129.166.224 - soeurn "GET /login/?login_only=1&user=soeurn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.234.253.225
country_id: 3469034
description:
[2026-07-03 19:41:54 +0000] info [cpaneld] 45.234.253.225 - soeu "GET /login/?login_only=1&user=soeu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.181.34
country_id: 2542007
description:
[2026-07-03 19:41:58 +0000] info [cpaneld] 160.176.181.34 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.143.29.75
country_id: 3686110
description:
[2026-07-03 19:42:01 +0000] info [cpaneld] 190.143.29.75 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.167.205.58
country_id: 102358
description:
[2026-07-03 19:41:37 +0000] info [cpaneld] 82.167.205.58 - soeurnde "GET /login/?login_only=1&user=soeurnde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnde (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
[2026-07-03 19:44:00 +0000] warn [queueprocd] The SMTP server “127.0.0.1” rejected the recipient “<root@ns5.netmaster.tg>” while attempting to send a message with the subject “[ns5.netmaster.tg] ⚠ Excessive Number of Failed Login Attempts from 81.171.74.69 (United Kingdom:GB)”


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.17.138.186
country_id: 3625428
description:
[2026-07-03 19:43:29 +0000] info [cpaneld] 38.17.138.186 - lepopulistetogo "GET /login/?login_only=1&user=lepopulistetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.74.69
country_id: 2635167
description:
[2026-07-03 19:43:59 +0000] info [cpaneld] 81.171.74.69 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.33.8
country_id: 3895114
description:
[2026-07-03 19:44:01 +0000] info [cpaneld] 190.114.33.8 - lep "GET /login/?login_only=1&user=lep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lep (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 93.185.162.128
country_id: 1643084
description:
[2026-07-03 19:43:34 +0000] info [cpaneld] 93.185.162.128 NEW zxtqbmmj:HwDZYj7WbNOmFHbj address=93.185.162.128,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.246.139.173
country_id: 3469034
description:
[2026-07-03 19:43:54 +0000] info [cpaneld] 170.246.139.173 - lepop "GET /login/?login_only=1&user=lepop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepop (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 81.171.74.69
country_id: 2635167
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[154.70.82.246] [Local Port]=[2083] [Remote IP Address]=[81.171.74.69] [Remote Port]=[55197] [Authentication Database]=[system] [Username]=[folifafa@fafagraphisme.com] (5/5 failures) (blocked until [Fri Jul  3 19:58:59 2026 UTC/Fri Jul  3 19:58:59 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.56.113.72
country_id: 2623032
description:
[2026-07-03 19:44:08 +0000] info [cpaneld] 109.56.113.72 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.12
country_id: 1880251
description:
47.128.121.12 - - [03/Jul/2026:19:44:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10470504&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fchampionnat-emirats-arabes-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783107866 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/championnat-emirats-arabes-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.0.238.245
country_id: 102358
description:
[2026-07-03 19:50:47 +0000] info [cpaneld] 159.0.238.245 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.20.139.227
country_id: 6251999
description:
[2026-07-03 19:50:41 +0000] info [cpaneld] 154.20.139.227 - lesnids "GET /login/?login_only=1&user=lesnids&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnids (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.74.217.86
country_id: 3469034
description:
[2026-07-03 19:50:25 +0000] info [cpaneld] 177.74.217.86 - lesnidsurbains "GET /login/?login_only=1&user=lesnidsurbains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.191.188.220
country_id: 2017370
description:
[2026-07-03 19:50:35 +0000] info [cpaneld] 46.191.188.220 - lesnidsu "GET /login/?login_only=1&user=lesnidsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.21.179
country_id: 1605651
description:
[2026-07-03 19:50:56 +0000] info [cpaneld] 184.22.21.179 - les "GET /login/?login_only=1&user=les&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user les (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.119.105.2
country_id: 597427
description:
[2026-07-03 19:50:20 +0000] info [cpaneld] 88.119.105.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.216.74.141
country_id: 3469034
description:
[2026-07-03 19:53:47 +0000] info [cpaneld] 201.216.74.141 - letabloi "GET /login/?login_only=1&user=letabloi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.121.112.33
country_id: 1643084
description:
[2026-07-03 19:53:37 +0000] info [cpaneld] 27.121.112.33 - letabloid "GET /login/?login_only=1&user=letabloid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.153.67.124
country_id: 3996063
description:
[2026-07-03 19:53:52 +0000] info [cpaneld] 187.153.67.124 - letablo "GET /login/?login_only=1&user=letablo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letablo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.105.197.205
country_id: 690791
description:
[2026-07-03 19:53:59 +0000] info [cpaneld] 176.105.197.205 - letab "GET /login/?login_only=1&user=letab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.133.115.23
country_id: 6252001
description:
[2026-07-03 19:53:50 +0000] info [cpaneld] 45.133.115.23 - EBOAH "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user EBOAH (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.80.28
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/49.jpeg HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.2.51
country_id: 3932488
description:
[2026-07-03 19:53:31 +0000] info [cpaneld] 179.6.2.51 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.167.233.163
country_id: 1282988
description:
[2026-07-03 19:53:42 +0000] info [cpaneld] 103.167.233.163 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.88.109.105
country_id: 6252001
description:
[2026-07-03 19:54:03 +0000] info [cpaneld] 72.88.109.105 - leta "GET /login/?login_only=1&user=leta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.70
country_id: 6251999
description:
[2026-07-03 19:54:07 +0000] info [cpaneld] 217.181.81.70 - supporthosting@cafe.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.199.58.212
country_id: 3658394
description:
[2026-07-03 19:55:02 +0000] info [cpaneld] 181.199.58.212 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.47.148.38
country_id: 1282988
description:
[2026-07-03 19:54:08 +0000] info [cpaneld] 163.47.148.38 - let "GET /login/?login_only=1&user=let&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user let (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.126.174.216
country_id: 3469034
description:
[2026-07-03 19:54:13 +0000] info [cpaneld] 189.126.174.216 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.6.147.55
country_id: 3508796
description:
[2026-07-03 19:54:52 +0000] info [cpaneld] 186.6.147.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.162.42.251
country_id: 2017370
description:
[2026-07-03 19:54:58 +0000] info [cpaneld] 192.162.42.251 - cafetg "GET /login/?login_only=1&user=cafetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.5.42.97
country_id: 3895114
description:
190.5.42.97 - - [03/Jul/2026:19:55:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738909&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-39010yitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783108501 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-39010yitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.5.42.97


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.65.57.18
country_id: 630336
description:
[2026-07-03 19:55:05 +0000] info [cpaneld] 128.65.57.18 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.59
country_id: 6252001
description:
[2026-07-03 19:56:46 +0000] info [cpaneld] 181.215.65.59 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.90.238.78
country_id: 2750405
domain: tdn.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.172.199.134
country_id: 3996063
description:
[2026-07-03 19:57:56 +0000] info [cpaneld] 187.172.199.134 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.131.112.248
country_id: 3996063
description:
[2026-07-03 19:57:53 +0000] info [cpaneld] 187.131.112.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.130.68.205
country_id: 3469034
description:
[2026-07-03 19:58:05 +0000] info [cpaneld] 177.130.68.205 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.130.7.81
country_id: 1522867
description:
[2026-07-03 19:58:19 +0000] info [cpaneld] 45.130.7.81 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.194.227
country_id: 1643084
description:
[2026-07-03 19:58:15 +0000] info [cpaneld] 182.253.194.227 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.196.89.143
country_id: 6252001
domain: www.myworkafrica.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.255.44.229
country_id: 3469034
description:
[2026-07-03 20:00:30 +0000] info [cpaneld] 131.255.44.229 - auditeccandcocom "GET /login/?login_only=1&user=auditeccandcocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandcocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.69.233
country_id: 290557
description:
[2026-07-03 20:00:46 +0000] info [cpaneld] 86.97.69.233 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.246.202.167
country_id: 1210997
description:
[2026-07-03 20:00:58 +0000] info [cpaneld] 43.246.202.167 - audi "GET /login/?login_only=1&user=audi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.154.188.253
country_id: 2542007
description:
[2026-07-03 20:00:20 +0000] info [cpaneld] 105.154.188.253 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.124.251.181
country_id: 1210997
description:
[2026-07-03 20:00:37 +0000] info [cpaneld] 103.124.251.181 - auditecc "GET /login/?login_only=1&user=auditecc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.125.13.134
country_id: 294640
description:
[2026-07-03 20:01:01 +0000] info [cpaneld] 185.125.13.134 - aud "GET /login/?login_only=1&user=aud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.179.5.252
country_id: 1210997
description:
[2026-07-03 20:04:48 +0000] info [cpaneld] 118.179.5.252 - afriquer "GET /login/?login_only=1&user=afriquer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriquer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.250.8
country_id: 6252001
description:
[2026-07-03 20:05:01 +0000] info [cpaneld] 172.56.250.8 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.73.41.253
country_id: 6252001
description:
[2026-07-03 20:04:50 +0000] info [cpaneld] 73.73.41.253 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.147.158.0
country_id: 6252001
description:
[2026-07-03 20:04:53 +0000] info [cpaneld] 35.147.158.0 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 84.247.133.56
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 84.247.133.56: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.197.182.91
country_id: 3469034
description:
[2026-07-03 20:04:54 +0000] info [cpaneld] 168.197.182.91 - afrique "GET /login/?login_only=1&user=afrique&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afrique (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.176.164.64
country_id: 3865483
description:
[2026-07-03 20:04:33 +0000] info [cpaneld] 190.176.164.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.150.185.65
country_id: 3469034
description:
[2026-07-03 20:04:43 +0000] info [cpaneld] 170.150.185.65 - afriquerevelationtg "GET /login/?login_only=1&user=afriquerevelationtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afriquerevelationtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.60.112
country_id: 6252001
description:
[2026-07-03 20:05:18 +0000] info [cpaneld] 172.56.60.112 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.248.113.133
country_id: 2589581
description:
[2026-07-03 20:05:07 +0000] info [cpaneld] 154.248.113.133 - afri "GET /login/?login_only=1&user=afri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afri (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.202.134.159
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-en-fete-togo-2000 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.206.121
country_id: 2363686
description:
[2026-07-03 20:06:03 +0000] info [webmaild] 196.168.206.121 - emt@emt.tg "POST /cpsess9038714172/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.29.120] != Current IP Address [196.168.206.121]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.83.36.146
country_id: 6252001
description:
[2026-07-03 20:05:10 +0000] info [cpaneld] 68.83.36.146 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.164.126.90
country_id: 6252001
description:
[2026-07-03 20:05:14 +0000] info [cpaneld] 98.164.126.90 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.250.242.249
country_id: 2542007
description:
[2026-07-03 20:05:10 +0000] info [cpaneld] 41.250.242.249 - afr "GET /login/?login_only=1&user=afr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afr (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.25||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.132.124.103
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:91.132.124.103||TA:91.132.124.103||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.79.183
country_id: 6252001
description:
[2026-07-03 20:07:22 +0000] info [cpaneld] 70.170.79.183 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.228.28.135
country_id: 6252001
description:
[2026-07-03 20:07:47 +0000] info [cpaneld] 129.228.28.135 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.92.179
country_id: 6252001
description:
[2026-07-03 20:07:43 +0000] info [cpaneld] 73.111.92.179 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.66.130.142
country_id: 6252001
description:
[2026-07-03 20:07:16 +0000] info [cpaneld] 173.66.130.142 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.129.117.172
country_id: 6252001
description:
[2026-07-03 20:07:13 +0000] info [cpaneld] 38.129.117.172 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.173.232.50
country_id: 6252001
description:
[2026-07-03 20:07:10 +0000] info [cpaneld] 73.173.232.50 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.210.226.154
country_id: 6252001
description:
[2026-07-03 20:07:40 +0000] info [cpaneld] 71.210.226.154 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.49.100.0
country_id: 6252001
description:
[2026-07-03 20:08:30 +0000] info [cpaneld] 45.49.100.0 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.83.194.51
country_id: 6252001
description:
[2026-07-03 20:08:45 +0000] info [cpaneld] 73.83.194.51 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.108.177.52
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-08.91.108.177.52||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.48.150.168
country_id: 6252001
description:
[2026-07-03 20:08:52 +0000] info [cpaneld] 174.48.150.168 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.2.38.64
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-08.50.2.38.64||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.255.1.77
country_id: 6252001
description:
[2026-07-03 20:08:48 +0000] info [cpaneld] 142.255.1.77 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.162.64.40
country_id: 6252001
description:
[2026-07-03 20:09:02 +0000] info [cpaneld] 98.162.64.40 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.63.18.11
country_id: 6252001
description:
[2026-07-03 20:08:41 +0000] info [cpaneld] 173.63.18.11 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.39.223.248
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/apotheose-odon-itsu-2023 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.56.214.174
country_id: 3932488
description:
[2026-07-03 20:10:02 +0000] info [cpaneld] 38.56.214.174 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.242.84
country_id: 99237
description:
[2026-07-03 20:09:28 +0000] info [cpaneld] 62.201.242.84 - caissede "GET /login/?login_only=1&user=caissede&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissede (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.191.41.60
country_id: 3686110
description:
[2026-07-03 20:09:56 +0000] info [cpaneld] 38.191.41.60 - cai "GET /login/?login_only=1&user=cai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.216.239
country_id: 6252001
description:
[2026-07-03 20:09:06 +0000] info [cpaneld] 67.172.216.239 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.244.131.30
country_id: 3996063
description:
[2026-07-03 20:09:12 +0000] info [cpaneld] 189.244.131.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.204.211.166
country_id: 3469034
description:
[2026-07-03 20:09:19 +0000] info [cpaneld] 138.204.211.166 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.163.12.177
country_id: 3469034
description:
[2026-07-03 20:09:48 +0000] info [cpaneld] 164.163.12.177 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.10.6.245
country_id: 1168579
description:
[2026-07-03 20:09:41 +0000] info [cpaneld] 157.10.6.245 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


